A supplier’s invoice arrives as expected. The amount looks right. The email sounds familiar. Then comes one small update: “We’ve changed bank accounts. Please use these new details for payment.”
That message can be enough to divert a legitimate payment into a criminal’s account.
Payment redirection fraud, also called business email compromise invoice fraud, doesn’t always involve a dramatic hack. Sometimes the attacker compromises a supplier’s email account. Sometimes they impersonate the supplier with a lookalike address. Either way, the goal is simple: change where the money goes before anyone notices.
The good news is that clear finance procedures can make this scam much harder to pull off.
How the invoice scam works
Fraudsters often target a real business relationship and a genuine payment that is already expected.
They may gain access to a supplier’s mailbox and monitor conversations. When a real invoice is due, they send a message from the compromised account, or interfere with an existing email thread, asking the customer to pay into a “new” account. Because the timing, invoice and conversation look legitimate, the request may not raise immediate suspicion.
Another method is to use a lookalike email domain: one with a subtle spelling change or extra character. The display name may still show the familiar supplier name, even though the actual email address is different.
The attacker may claim the account change is temporary, blame an audit or banking issue, or say the payment must be made quickly to avoid a delay. That pressure is deliberate: the less time staff have to check, the greater the chance they’ll follow the new instructions without question.
Government guidance on business email compromise advises businesses to independently verify changes to payment details rather than relying on email alone.
Red flags in a “new bank details” message
A request to change bank details should always trigger a pause, even if it appears to come from a known supplier.
Look for:
- Unexpected account changes: The supplier has never mentioned a change before, or the request arrives separately from the invoice.
- Urgency or pressure: You’re asked to pay immediately, keep the change confidential or skip the usual approval process.
- A new or unusual email address: Check the full sender address, not just the display name. Look for extra characters, altered spellings or a different domain.
- A change in tone or writing style: The message may use unfamiliar wording, punctuation or sign-offs.
- Instructions that differ from the normal process: For example, the supplier asks you not to call, or provides a new phone number in the same email.
- A message that seems to come from an ongoing email thread: A familiar conversation does not prove the sender is genuine. A real mailbox could be compromised.
One warning sign on its own may not prove fraud. But any request to change where money is sent should be treated as unverified until your team checks it through a separate, trusted channel.
Build verification into the payment process
A strong process shouldn’t depend on one employee spotting every suspicious message. Make verification part of the normal workflow.
1. Call a number you already trust
Before changing supplier bank details, call the supplier using a number already held in your records or obtained independently from their official website. Do not use a phone number included in the change request.
Speak to an authorised contact and confirm the change verbally. Check the account name and payment details carefully, and make a note of who confirmed them, when, and how.
If you can’t reach the supplier through a trusted number, leave the change on hold. A short delay is preferable to sending funds to an unverified account.
2. Require two people to approve changes
One person can receive and document the request; another can independently verify it and approve the update. Where practical, separate the person who enters new payment details from the person who releases the payment.
Dual authorisation matters most when details change or a payment is unusually large. It adds a second chance to catch a mistake, a spoofed message or an instruction designed to bypass controls.
3. Set clear finance rules
Write down what staff must do when a supplier requests a change. The procedure should say:
- Bank-detail changes are never accepted on email alone.
- Every change requires a callback to a previously verified number.
- An independent approver must sign off before the details are updated or used.
- Payment details should be confirmed against the approved supplier record.
- Urgency is a reason to verify, not a reason to skip verification.
Keep approved supplier details in a controlled system, with a record of who changed them and when. Make it easy for staff to pause a payment and raise a concern without being criticised for slowing things down.
4. Brief everyone who handles invoices
Fraud prevention isn’t only an IT issue. Brief finance staff, business owners, office managers and anyone who approves invoices. Show them examples of suspicious wording and lookalike sender addresses, and practise the callback procedure.
Make the rule simple enough to remember: a request to change payment details must be verified outside the email conversation.
Where cloud email security fits
Cloud email accounts hold valuable information: supplier conversations, invoice history, contact details and clues about when payments are made. That makes a finance mailbox an attractive target. Access to it can help an attacker create a convincing request, or hide evidence of one.
A suspicious sign-in alert, such as an unfamiliar device, location or login pattern, should be investigated promptly. If an attacker takes over a mailbox, they may also create rules that automatically forward, archive or delete messages. Those rules can hide the real invoice thread or replies warning that the new account is fraudulent.
When an email account may be compromised, an administrator should check for unfamiliar sign-ins, active sessions, forwarding settings and mailbox rules. They should secure the account, remove unauthorised access and review related accounts or messages as appropriate. Don’t assume that changing a password alone has resolved the incident.
These checks are part of a broader approach to account security and ongoing support. Find out more about our managed IT support and technical support services.
Backup is also recommended as part of a sound managed IT plan. It can help with recovery of business information, but it does not reverse a bank transfer or replace payment verification. Backup should be planned for your organisation’s needs; it is not bundled or free.
Payment sent? What to do in the first hour
Act immediately. Don’t wait to confirm every detail before reporting a suspected fraudulent payment.
- Call your bank using an official number. Use the number on your bank card, statement or official website, not anything in the suspicious email. Tell the bank it may be payment redirection fraud and ask whether the transfer can be stopped, recalled or traced.
- Alert the person responsible for finance and business leadership. Pause other payments to the same account and check whether any other invoices or supplier details may have been affected.
- Contact the genuine supplier through a trusted channel. Explain what has happened and ask them to secure their email account if they suspect it has been compromised.
- Notify your IT support team or email administrator. Ask them to investigate the mailbox, sign-in activity, forwarding rules and any other suspicious access. Follow their guidance to secure affected accounts.
- Preserve evidence. Keep the original emails, invoice, payment receipt, account details and relevant timestamps. Don’t delete suspicious messages or forward them as if they were genuine.
- Report the incident. Follow the Australian Cyber Security Centre’s business email compromise recovery guidance and report the scam to Scamwatch.
A fast response may improve the chances of limiting the loss, but recovery is not guaranteed. Keep a record of the steps taken and follow instructions from your bank and incident response contacts.
A simple rule can protect a large payment
Payment redirection fraud succeeds when a plausible email meets an unclear process. Make bank-detail verification routine, use a known phone number, require a second approval and give staff permission to pause a payment.
If you’d like help strengthening your email security, finance workflows or broader IT support, book a free 15-minute consult online or call 1800 312 972.
About Mathew Hoffman
Mathew Hoffman started his IT career in 1981 and has held senior roles at State Bank of NSW, Minet Australia, Wilhelmsen Lines and Rothmans of Pall Mall. His career highlights include work connected with the Sydney 2000 Olympics.
Since 2001, Mathew has provided IT consultancy to small and medium businesses. He became an original Google Partner in 2008, and the business re-branded as Cloud Computer Company in 2017.
Based in Noosa, Mathew enjoys cricket, which he has played and coached in Sydney and the Sunshine Coast, as well as family time, the beach and golf.
Meta Title:
Suggested URL Slug: /payment-redirection-fraud-invoice/
Suggested WordPress Tags:
Meta Description:
Focus key phrase:
