Invoice Fraud and Fake Supplier Requests

Why small businesses are attractive targets

Paying invoices is routine. Someone receives a bill, checks it looks roughly right and sends the money. Fraudsters exploit that routine, because a request that blends in with normal business is unlikely to be questioned. Smaller organizations are often targeted because they may have fewer formal approval steps, one person handling payments, and little time to check each request.

Invoice fraud is a type of business payment fraud. The money is sent willingly, to an account that belongs to the criminal, so recovering it can be difficult.

The common versions

Forged or invented invoices. A bill arrives from a company you have never dealt with, or for goods nobody ordered. It may be sent in bulk in the hope that some will be paid without a check. Look-alike invoices that imitate a known supplier’s layout are common.

Changed bank details. A message that seems to come from a regular supplier says its bank account has changed and asks you to use the new details for future payments. Everything else about the relationship looks normal, which is exactly why it works.

Impersonating an executive. An email appearing to come from the owner or a senior manager tells a staff member to make an urgent payment and not to discuss it. This is a form of business email compromise.

Compromised supplier accounts. Sometimes the supplier’s real email account has been taken over. The fraudster can then reply inside genuine conversations with a genuine-looking invoice, but with altered payment details.

Fake services and renewals. Notices for domain renewals, directory listings or software subscriptions that look like invoices but relate to nothing you actually bought.

How the scam tends to unfold

Fraudsters usually do homework first. They may learn who your suppliers are from public information, a breach, or an earlier compromise of someone’s mailbox. They time the request to land when an actual payment is due, and they borrow familiar names, logos and wording. This is social engineering applied to accounts payable: authority, urgency and routine are the levers.

Warning signs

• A change to bank details, especially if it arrives by email alone, or the new account is in a different name, bank or country than you would expect.
• Pressure to pay quickly, or to skip the usual approval.
• Slightly different contact details, such as a new reply-to address or a lookalike domain, which can be easy to miss on a phone. The same checks used to recognize a phishing email apply here.
• Invoices with no purchase order, or for work you cannot match to anything.
• Unusual payment methods, or requests for secrecy.
• Round numbers, vague descriptions or a total that differs from the agreed quote.
• Messages that discourage a phone call.

None of these is conclusive, but any change involving money deserves a second look.

Controls that help

Most protections are process, not technology, and they cost little.

1. Verify changes by a separate channel. If a supplier says its bank details have changed, call a phone number you already have on file, not one in the message. Ask for a name you recognize, and record that the check was made.
2. Separate duties. Where possible, the person who enters or changes supplier details should be different from the person who approves the payment.
3. Match before paying. Compare each invoice to an order, a delivery or an agreed contract. An invoice that matches nothing should wait.
4. Keep a supplier list. Maintain a record of approved suppliers and their verified details, and treat any new entry or edit as a flagged event.
5. Set approval rules. A second approval above a chosen amount, and for any first payment to a new account, makes a single mistake less costly.
6. Protect the mailboxes. Using two-factor authentication on email and finance accounts makes it harder for criminals to hijack a conversation. Strong password policy and avoiding password reuse reduce the chance of that happening.
7. Train the people who pay. Short, regular security awareness training that includes realistic payment scenarios is more useful than a general warning. Staff should know it is acceptable, even expected, to question an urgent request, including one that appears to come from the boss.
8. Consider your suppliers’ exposure. Third-party risk matters here too: a compromise at a supplier can reach you through genuine-looking messages.

Some businesses also use payment systems that confirm the account holder’s name before money is sent, where available. Options vary by country and bank, so ask your provider what checks they offer.

If you think you have paid a fraudulent invoice

Time matters. General steps, which a professional adviser can refine for your situation:

• Contact your bank immediately and ask whether the payment can be stopped or recalled. Outcomes are uncertain, and they are usually better when the report is made within hours.
• Gather the evidence: the email with full headers if you can, the invoice, the payment record and any phone numbers used.
• Secure your accounts. Change passwords on the affected mailbox and finance systems and check for unfamiliar forwarding rules.
• Warn the genuine supplier that their name or account may have been abused.
• Report it to the relevant fraud-reporting body or police in your country.
• Review what happened with your team, without blame, so the process can improve. Your incident response plan, if you have one, should guide this.

A simple rule to remember

Never change where money goes on the strength of a message alone. A short, documented call-back to a known number is cheap protection, and it is the one step most successful invoice scams depend on you skipping.