Fake invoice scams: verify before you pay
Fake invoice fraud is simple and effective. A criminal sends a convincing bill, or a message that appears to come from a real supplier, asking you to pay into a new bank account. By the time the real supplier asks where their money is, the funds are gone.
How the scam works
Attackers either register a lookalike domain, such as one with an extra letter, or break into a real mailbox and reply inside an existing conversation. The message often mentions a genuine project, which makes it believable.
Warning signs
- A change of bank details, especially with a request for urgency
- Slight differences in the sender address or company name
- Pressure to pay today or to keep the change confidential
- A new payee with no history in your records
How to protect your business
Confirm every change of bank details by phoning a number you already hold, never one in the email. Require two people to approve new payees and large payments, and train accounts staff to expect this scam. If you have paid a fraudster, call your bank immediately, because early action can sometimes recover funds, and report the fraud to the authorities.
Key takeaway: verify bank detail changes by phone, using a number you already trust.
