Invoice and payment fraud: how it works and the controls that catch it

What are the main types of invoice and payment fraud?

The main types are invoice redirection, business email compromise and CEO fraud. In each, the fraudster poses as someone your company already trusts, such as a supplier, a colleague or the chief executive, and asks for money to go to a new account. Because the payment looks routine, nobody thinks to question it.

How does a typical payment fraud unfold?

A typical payment fraud moves through research, access or imitation, a patient wait and a well-timed request. The fraudster learns who pays whom, gets into a mailbox or copies one, waits for a real invoice or a busy week, then sends new bank details. Once the payment lands, the money is moved on within hours.

1. Research

   Websites, social media and public records reveal your suppliers, who approves payments and when senior people are away.

2. Access or imitation

   A phishing email captures a password, or the fraudster registers a web address one character away from a supplier's.

3. Waiting

   Inside a compromised mailbox they may watch quietly for weeks, sometimes adding rules that hide replies from the real owner.

4. The request

   New bank details, or an urgent payment request, arrive at a convenient moment: month end, the day before a holiday, or while the boss is travelling.

5. Cash out

   The money is split and moved through other accounts, often the same day. Hence the importance of the first hour.

A fictional example puts the stages together. On a Thursday afternoon, the accounts assistant at a small distributor gets a reply in a real email thread with the company's packaging supplier. The supplier has 'moved banks', the new details are attached on headed paper, and the $38,400 invoice due on Friday should go to the new account. The thread is genuine. The supplier's mailbox had been compromised three weeks earlier, and only a call-back on the number already on file would have caught it.

What are the warning signs of payment fraud?

The warning signs of payment fraud are changed bank details, urgency, secrecy and a request to skip your normal process. Watch as well for small differences in email addresses, an account in an unexpected country or name, wording that doesn't sound like the sender, and a sender who suddenly can't be reached by phone.

• Bank details change by email or letter shortly before a payment is due.
• The request is urgent, and the approval steps 'can be sorted out afterwards'.
• You're asked to keep it to yourself because a deal is confidential.
• The address is nearly right: a swapped letter, an extra word, or a reply-to address that differs from the sender's.
• The new account is in another country, in a person's name, or at a bank the supplier has never used.
• The tone is off: odd phrasing, a different sign-off, or a senior colleague asking for something they've never asked for before.
• The sender can't talk just now and wants to keep everything on email or messages.

Which payment controls stop invoice fraud?

The controls that do most are simple: two people approve every payment, any change of bank details is confirmed by phoning a number you already hold, payee name checks are used wherever the bank offers them, and limits trigger extra approval. They only work if they bind everyone, directors included, every single time.

A small test payment proves nothing: a fraudster will happily confirm it arrived. Payee name checks are worth switching on wherever your bank offers them; many banking systems now compare the account name with the payee you entered before the money leaves. Fitting controls like these to a small team, without slowing every payment down, is part of our cash flow and treasury service.

How should you verify a change of bank details?

Verify a change of bank details by phoning the supplier on a number you already hold, from a past contract, invoice or your own records, never the number in the request. Speak to someone you know, have them confirm the new account number and name, record the conversation, and get a second person to approve the change.

1. Don't act on the email or letter. Log the request and put the supplier's record on hold.
2. Find a phone number independently, from your own files or a contract signed before the request arrived.
3. Ring, and ask the supplier to read the new details to you, rather than reading them out yourself.
4. Write down who you spoke to, when, and exactly what they confirmed.
5. Have a second person check that note and approve the change in your system.
6. Tell the supplier's usual contact, by a separate route, that the change has been made, so they can raise the alarm if they never asked for it.

How do you train staff to spot payment fraud?

Train staff by walking through real examples of fraudulent requests, rehearsing the call-back and approval steps, and making it clear nobody will be blamed for delaying a payment to check it. Directors should say openly that they will never ask for an urgent payment that skips the process, and then stick to it.

Keep sessions short and regular, and include everyone who can raise, approve or change a payment: part-time staff, assistants to senior people, whoever covers holidays. New starters should hear the rules in their first week, before anyone tests them.

Back the training with basic email security. Turn on multi-factor authentication for every mailbox, tag messages from outside the company, and check now and then for forwarding rules nobody remembers creating. National cyber security agencies in many countries publish plain guidance on these basics for small organisations. Finally, tell your own customers that your bank details will never change by email alone, so nobody can run the same fraud on them in your name.

What should you do in the first hour after a fraudulent payment?

In the first hour after a fraudulent payment, ring your bank's fraud line on a number from its website or card, and ask it to recall the payment and contact the receiving bank. Then secure the email accounts involved, report the fraud to the police, keep every record and tell your insurer.

1. Ring your bank

   Give the amount, time, receiving account and payment reference. Ask the bank to contact the receiving bank and try to freeze the funds, and note the name of the person you speak to.

2. Stop further payments

   Pause anything else due to the same account, and check whether other suppliers' bank details were changed recently.

3. Secure email

   Change passwords on the affected accounts, sign out every session, turn on multi-factor authentication and remove forwarding rules you don't recognise.

4. Report it

   Report the fraud to the police or the national fraud reporting service, and to any dedicated service for internet fraud in your country. Keep the reference number, because your bank may ask for it.

5. Preserve the evidence

   Save the emails with full headers, plus invoices, call notes and payment confirmations. Don't delete anything, even from a compromised mailbox.

6. Tell the people affected

   Inform your directors, insurer and auditor, and the genuine supplier, whose own systems may have been compromised too.

Speed gives the best chance, but money isn't always recovered. Afterwards, trace how the payment got through and close the gap. Then look at the cash position: a large loss can change what you can pay over the coming weeks, and a 13-week cash flow forecast shows that early. If the hole means borrowing, the lender will expect a financial model it can test.

Where can you get official help with payment fraud?

• Your bank's fraud team, on the number from its website or your card: the first call after any suspicious payment.
• The police or your national fraud reporting service, which may also run a dedicated route for business email compromise.
• Your country's national cyber security agency, which typically publishes guidance for small organisations on phishing and securing email.
• Your bank's own information on payee name checks and how to switch them on.

Use contact details from official websites you've typed in yourself, not from the message that raised the alarm.

How can BrndTst help?

BrndTst designs payment controls around how your finance team actually works: approval rules and limits, a procedure for bank-detail changes, a one-page payment policy and a first-hour response plan. We write them with the people who make payments, test them against the frauds described here, and hand them over for your team to run.

The controls sit within our treasury and payment controls work, alongside the 13-week forecast, and everything else we do is on our services page. If you'd like your approval process looked at before anything goes wrong, get in touch and describe how payments are set up and approved today. Our page on what happens after you write to us explains how a project runs from there.