Payment redirection and invoice fraud: the quiet, expensive scam

The usual entry point is a compromised email account, either at the supplier or at the customer. Credentials are obtained through a phishing page, then the mailbox is monitored quietly for weeks while the criminal learns who pays whom, on what terms and in what tone.

When a large invoice is due, they act. Sometimes they reply within the real thread from the real account; sometimes they register a near-identical domain, swapping a letter or adding a word, so the reply looks right at a glance. A mailbox rule often hides their messages from the legitimate owner.

Supplier bank-detail changes are the classic form: an invoice arrives with new account details, or a follow-up email corrects the details on an invoice already sent. The CEO or executive variant asks a finance employee for an urgent confidential transfer, usually while the executive is supposedly travelling and unreachable by phone.

The third targets individuals in high-value transactions, most damagingly conveyancing. A homebuyer receives 'updated' account details for a deposit or completion payment from what appears to be their solicitor. These are among the largest single-transaction losses reported anywhere.

Verify every change of bank details by voice, on a number you already hold, never a number in the email requesting the change. This single rule prevents the great majority of losses and costs a two-minute phone call against a five- or six-figure risk.

Make it a written policy rather than a habit, because the scam targets junior staff under time pressure who do not feel able to question an executive or delay a supplier. Staff must know that delaying a payment to verify it is always the correct decision and will never be criticised.

Enforce multi-factor authentication on every business mailbox, ideally with phishing-resistant methods such as passkeys or hardware keys, since mailbox compromise is the root cause. Monitor for mailbox rules that forward or auto-delete messages, a reliable indicator of an intruder.

Register lookalike domains where feasible, configure SPF, DKIM and DMARC so spoofed mail is rejected, and tag external email visibly in the client so a message that appears to come from a colleague is obviously outside. Our small business security checklist covers the wider set-up.

Call your bank within minutes rather than hours and ask for an immediate recall, then contact the receiving bank's fraud team as well. Money is usually moved onward quickly, so the recovery window is measured in hours.

Then treat it as an intrusion, not just a payment error. Reset passwords and revoke sessions on the affected mailboxes, remove unauthorised rules, check who else in the thread may be compromised, and warn the counterparty. Report to Action Fraud in the UK, IC3 in the US, ReportCyber and Scamwatch in Australia, the Canadian Anti-Fraud Centre, or 1930 and cybercrime.gov.in in India.