How to prevent invoice fraud and payment redirection scams

We earn a commission if you buy through some links on this page, at no extra cost to you. It never affects the order. How we make money.

Invoice fraud tricks a business into paying money to criminals, usually by sending a fake invoice or by impersonating a real supplier and asking for payments to go to a new bank account. It is one of the most costly frauds affecting small businesses, and once money is sent, it is often hard to recover. This guide explains how these scams work, the warning signs, the controls that prevent invoice fraud, and what to do immediately if you are targeted.

How invoice fraud works

The most common form is payment redirection, also called business email compromise. Criminals gain access to a supplier's or your own email account, or create a lookalike email address, watch real conversations, and then send a message at the right moment: "We have changed banks; please pay this invoice to our new account." The email looks genuine, references real invoices and comes at a time when payment is expected.

Other forms include completely fake invoices for services never ordered, duplicate invoices, inflated invoices, and fake "urgent" payment requests that appear to come from a company director.

Warning signs

• A request to change bank details, especially by email alone.
• Urgency or pressure: "pay today or the shipment will be held".
• A new bank account in a different country or name from the supplier.
• Small differences in the sender's email address or domain.
• Changes in writing style, tone or signature.
• Requests to keep the payment confidential.
• Invoices for unfamiliar services, or from unknown suppliers.
• A director asking for an unusual payment while unreachable by phone.

Control 1: verify bank detail changes by phone

The single most effective control: never change a supplier's bank details based on an email, letter or invoice alone. Call the supplier on a phone number you already have on file, not one in the message, and confirm the change with someone you know. Record who confirmed and when. Apply the same rule to new suppliers: verify their details through a separate channel before the first payment.

Control 2: dual approval for payments

Require two people to approve new payees, changes to bank details, and payments above a set amount. Most business banking and expense platforms support approval workflows. Dual approval stops a single deceived person from sending money, and makes insider fraud harder. Separate duties so the person who sets up payees is not the only one who approves payments. See expense management software for tools with approval controls.

Control 3: match invoices to orders

Only pay invoices that match a purchase order, contract or confirmed delivery. Check amounts, dates and services against what was ordered. For regular suppliers, compare with previous invoices. A simple three-way match, order, delivery and invoice, catches fake and inflated invoices. Accounting software can flag invoices from unknown suppliers or duplicates; see the accounting software ranking.

Control 4: secure your email

Many invoice frauds start with a compromised email account. Protect accounts with strong unique passwords in a password manager and two-factor authentication. Set up SPF, DKIM and DMARC on your domain so criminals cannot easily send emails that appear to come from you; see email deliverability: SPF, DKIM and DMARC. Watch for suspicious login alerts and unexpected forwarding rules, which attackers create to monitor conversations.

Control 5: train your team

Staff who handle payments should know the warning signs, the verification rules and that they will never be criticised for checking. Run short training sessions with real examples, and remind people before busy periods such as year end. Make it clear that urgent requests from directors must still follow the process. A culture where checking is normal is the best defence.

Protect your own customers

Criminals may also impersonate your business to your customers, sending fake invoices with altered bank details. Protect customers by telling them your bank details will never change by email, including that notice on invoices, using DMARC to reduce spoofing, and confirming any changes through a known channel. If customers receive suspicious emails claiming to be from you, ask them to call you. See how to invoice international clients.

Payment methods and fraud

Bank transfers are hard to reverse once sent. Card payments offer some chargeback protection, and some payment platforms offer confirmation-of-payee checks that show whether the account name matches the payee you entered. Use these features where available. For paying suppliers abroad, see how to pay overseas suppliers and compare providers in the business accounts ranking.

Supplier master data controls

Keep supplier details, including bank accounts, in one controlled place, such as your accounting system, with changes restricted to a few people and logged. Review the supplier list periodically for duplicates, inactive suppliers and changes. Alert the team if anyone requests access they do not need. Fraudsters sometimes target the person who maintains supplier records directly.

What to do if you are targeted

1. Contact your bank immediately and ask them to stop or recall the payment. Speed matters.
2. Report the fraud to the police and your country's fraud reporting body.
3. Secure email accounts: change passwords, check forwarding rules, review logins, and enable 2FA.
4. Inform the genuine supplier so they can check their own systems.
5. Preserve evidence: emails, headers, invoices and payment records.
6. Review controls to prevent a repeat.

Insurance

Some business insurance policies cover cyber incidents or social engineering fraud, often with specific conditions such as requiring verification procedures. Check what your policy covers and whether your controls meet its requirements. Insurance is a backstop, not a substitute for prevention.

A one-page payment security policy

• Bank details are only changed after phone verification on a known number.
• New payees and changes require two approvals.
• Payments above a set amount require two approvals.
• Invoices must match an order or contract.
• Urgent requests follow the same process as any other.
• Suspicious requests are reported to a named person.
• All finance accounts use 2FA.

Common mistakes

• Changing bank details from an email.
• Calling the phone number given in the suspicious email.
• One person able to add payees and send payments alone.
• No 2FA on email or banking.
• Skipping checks for "urgent" requests from directors.
• Delaying contact with the bank after a fraudulent payment.

Example: a supplier's hacked email

A small manufacturer received an email from a long-standing supplier's real email address with an invoice and a note that their bank had changed. The supplier's email had been hacked. The finance assistant followed the company's rule and called the supplier's accounts contact on the number in the supplier file. The supplier confirmed no change had been made and discovered the breach. The fraudulent payment was never sent, and the supplier warned its other customers.

Example: a director impersonation

A finance officer at a services firm received an email appearing to come from the managing director, who was travelling, asking for an urgent confidential payment to secure a deal. The email address differed by one letter from the real domain. Because company policy required phone confirmation for any unusual payment request, she called the director, who knew nothing about it. The firm then set up DMARC and registered lookalike domains to reduce future impersonation.

Fake invoices for services not ordered

Some scams send invoices for directory listings, domain renewals, advertising or software that were never ordered, hoping busy staff will pay without checking. Others impersonate trademark or company registries with official-looking letters. Train staff to check that every invoice relates to a known order or contract, and to ask before paying unfamiliar suppliers. Keep a list of genuine recurring suppliers and subscriptions.

Using technology to help

Accounting and expense tools can flag new suppliers, bank detail changes and duplicate invoices, and enforce approval workflows. Banks may offer payee name checks and alerts for new payees. Email security tools flag external senders and lookalike domains. Use these features, but do not rely on them alone: the phone verification rule and dual approval remain essential. See expense management software and the expense cards ranking.

Remote teams and invoice fraud

Remote and distributed teams communicate mostly by email and chat, which fraudsters exploit. Agree on verification channels that cannot easily be impersonated, such as a known phone number or video call, and use them for payment changes. Never approve payments based on chat messages alone. See the remote team software stack for secure collaboration tools.

Password managers and fraud prevention

Many invoice frauds start with stolen passwords. A password manager generates unique passwords for every account, so one breach does not expose others, and its autofill will not fill passwords on fake login pages. Combine it with two-factor authentication on email and finance accounts for strong protection.

Training scenario for your team

Run a short exercise: show staff a realistic email from a "supplier" with new bank details and an invoice, and ask what they would do. Discuss the warning signs, walk through the verification process, and practise the phone call. Repeat with a "director" asking for an urgent payment. Ten minutes of practice makes the correct response automatic when a real attempt arrives under time pressure.

Payroll diversion scams

A related scam targets payroll: criminals impersonate an employee by email and ask HR to change their salary bank account. Apply the same rule: verify bank detail changes directly with the employee through a known channel, ideally in person or by phone, and notify them at their old contact details. Payroll systems that let employees update details only through authenticated self-service reduce the risk.

Reporting and learning

Encourage staff to report suspicious messages even if they did not act on them. Keep a simple log of attempts: what arrived, from whom, and how it was spotted. Patterns help you warn suppliers and customers, update training, and improve controls. Share near misses openly so everyone learns. Fraud prevention improves fastest in teams where reporting is normal and blame-free.

Checklist before paying any invoice

1. Is the supplier known, and does the invoice match an order or contract?
2. Are the bank details the same as on file?
3. If details changed, has someone verified them by phone on a known number?
4. Is the amount and timing what you expected?
5. Has a second person approved it if required?
6. Is there any unusual urgency or secrecy?

Questions