How a small business gets hit by invoice fraud

The pattern is almost always the same: an email that looks like it’s from a vendor you already work with, saying their bank details have changed, please send the next payment to this new account instead. It’s polite, it references a real invoice, and it costs businesses real money because it looks completely normal.

How it actually happens

Usually, one side’s email account (yours or the vendor’s) has been quietly compromised, and the attacker is reading real correspondence, waiting for an actual invoice to be in progress. They then send a message — sometimes from the real compromised account, sometimes from a lookalike domain that’s one letter off — asking for payment to be redirected to a new account “due to a banking change.” Because it references a real invoice amount and a real ongoing relationship, it doesn’t trigger the suspicion a random scam email would.

The single habit that stops almost all of it

Never change payment details based on an email alone. If a vendor says their bank account changed, call them — using a phone number you already have on file, not one provided in the email — and verbally confirm before sending anything to a new account. This one habit defeats the vast majority of invoice fraud, because the attacker doesn’t control the phone line.

Other warning signs

• Urgency. “This needs to go out today” is a pressure tactic to skip verification.
• A slightly different email domain. vendor-name.com versus vendor–name.com, or an extra letter. Easy to miss at a glance.
• A reply-to address that doesn’t match the sender. Worth checking on anything involving payment changes.
• Requests to keep the change confidential or not mention it to the usual contact — a genuine business change wouldn’t need that.

What to check on your own accounts

If your business email was the one compromised, the same attacker may be watching all your outgoing invoices, not just one. If you suspect this, check your email account’s recent sign-in activity and any forwarding rules you didn’t set up — a common trick is a hidden rule that silently forwards or hides incoming messages from your vendors so you don’t see them getting redirected. We’ve written about how to check whether your email account has been accessed.

A simple policy worth adopting

Any change to payment or banking details, from anyone, gets a phone call to a known number before anything is sent. Put this in writing for anyone on your team who handles payments — it costs nothing and closes the door on the most common version of this fraud.

When it’s worth calling someone

If you think an account may already be compromised, or you want your email security and payment processes reviewed properly, that’s part of the small business IT support we provide across the Upper West Side and Manhattan.