In short
Invoice fraud is when criminals send a fake invoice, or tell you a real supplier's bank details have changed, so you pay into their account. It usually arrives by email from a lookalike domain or a supplier's compromised mailbox. Supplier impersonation detection, lookalike-domain checks, external banners, DMARC and a verification process stop it.
Get a quote for email protection against invoice fraud
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What is invoice fraud?
Invoice fraud, also called payment diversion or mandate fraud, is a type of BEC attack aimed at accounts payable. It takes two main forms:
- Fake invoices: an invoice for goods or services that were not supplied, often for a plausible amount and from a name that resembles a real supplier
- Changed bank details: a genuine invoice, or a message about future invoices, saying the supplier has moved banks and payments should go to a new account
The second form is the more dangerous, because the invoice itself is often real. Only the destination account has changed. It can also work in reverse: criminals posing as your organisation can tell your customers that your bank details have changed.
How invoice fraud emails get past filters
Invoice scam emails rarely contain anything a traditional filter would block. The common techniques are:
- Compromised supplier mailbox: the attacker has signed in to a real supplier's account and replies in a genuine thread, so the message passes SPF, DKIM and DMARC and looks entirely normal
- Lookalike domain: a domain one character different from the supplier's, or with a different ending, registered with valid authentication records so it passes checks too
- Display-name tricks: the supplier's name in the display name on a free webmail address, relying on phones that show only the name
- Reply-to diversion: the visible sender looks right, but replies go to an address the attacker controls
- Edited documents: a real PDF invoice with only the bank details changed
- Timing: messages sent near month end, before holidays or when a known contact is away, to add pressure
Because the content is ordinary business correspondence, catching these emails depends on spotting that something about the sender or the relationship is unusual.
Warning signs in an invoice scam email
Staff who handle payments should treat these as reasons to stop and verify:
- A change of bank details, sort code or account name, especially by email alone
- A sender address that differs slightly from previous correspondence, or a reply-to address that differs from the sender
- Pressure to pay quickly, or a request to keep the change confidential
- An explanation for the change, such as an audit, a new bank or a problem with the old account
- A first-time payee, or an invoice outside the usual pattern for that supplier
- Small differences in tone, signature or formatting compared with earlier emails
Training staff to spot these is covered on our sister site, including business email compromise training. This page focuses on the technical controls.
Email controls that stop fake invoices
The controls below reduce how many invoice fraud emails reach accounts payable, and give staff a visible warning on those that do.
| Control | What it catches | Where it comes from |
|---|---|---|
| Supplier and relationship analysis | Unusual requests from known contacts, including compromised supplier accounts | API-based products such as IRONSCALES, Check Point Email Security and FortiMail Workspace Security |
| Writing style analysis | Messages that do not match how the supposed sender normally writes | Trend Micro (TrendAI Vision One Email and Collaboration Security) |
| Lookalike-domain detection | Domains that closely resemble your own or a supplier's | Defender for Office 365 domain impersonation protection; Gmail's similar-domain setting; third-party layers |
| Display-name checks | A known name on an unknown address | Gmail's employee-name spoofing setting; Defender user impersonation protection; third-party layers |
| External and first-contact warnings | New or rarely seen senders | Microsoft's first contact safety tip; banners in several third-party products |
| DMARC on your domain | Criminals invoicing your customers from your exact domain | Your own DNS; see email authentication |
| Account takeover detection | Your own mailboxes being used to send fraudulent invoices | Several API products; see email account takeover |
| Post-delivery removal | Fraudulent messages found after delivery, removed from every mailbox | API-based products |
No control catches every case, which is why the verification process below matters as much as the technology.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
A payment verification process
A short, written process is the control that stops the money leaving even when a fraudulent email gets through:
- Treat any change of bank details received by email as unverified.
- Confirm the change by contacting the supplier on contact details already held on your system, not those in the email or invoice.
- Have a second person approve the change before it is used.
- Use your bank's Confirmation of Payee check and investigate any mismatch.
- Record who verified the change, when and how.
- Apply the same process to your own customers: tell them how you will notify any change to your bank details, so they can spot a fake.
If you have paid a fake invoice
Speed matters. If you think a payment has gone to a fraudster:
- Contact your bank straight away using its official contact details and ask it to try to recover the funds.
- Report it to Report Fraud, the national fraud and cyber crime reporting service that has replaced Action Fraud for England, Wales and Northern Ireland. In Scotland, report it to Police Scotland.
- Tell the genuine supplier through a channel you already trust, as their mailbox may be compromised.
- Check your own mailboxes for signs of compromise, such as unfamiliar inbox rules or forwarding.
- Forward the fraudulent email to your IT team and keep a copy as evidence.
Our sister site explains how to report phishing in more detail.
Is email protection against invoice fraud the right fit for you?
We will check it against your systems and requirements and recommend the right option.
How we help
We can help you put email controls in front of your accounts payable team on Microsoft 365 or Google Workspace. We can:
- Review your impersonation, external-sender and DMARC settings
- Trial a product that analyses supplier relationships in monitoring mode, where the product supports it, so you can see what it would flag
- Recommend, license and deploy the option that fits, with package contents confirmed at quote
Ask us for a quote: Contact us about stopping invoice fraud by email.
How Forever Systems helps with email security
We are an independent UK IT and cyber security provider. We supply several email security platforms, so we can suggest what suits your mail system, your risks and your budget rather than pushing one product.
- Start with what you have: we can review the protection already built into Microsoft 365 or Google Workspace before suggesting anything extra
- Compare like for like: API-based protection, secure email gateways, encryption and DLP from the vendors we supply, explained in plain English
- Get authentication right: we help you plan SPF, DKIM, DMARC and MTA-STS so genuine mail is delivered and spoofed mail is not
- Deployment help: connecting a platform to Microsoft 365 or Google Workspace, mail routing changes and policy set-up, scoped at quote
- People and backup too: security awareness training, Check Point Harmony Email & Collaboration and Sophos from our specialist sites
Tell us about your mail system and we will suggest options, with pricing confirmed at quote.
Frequently asked questions
What is invoice fraud?
Invoice fraud is when criminals trick an organisation into paying a fake invoice, or into paying a genuine invoice into a criminal's account by claiming a supplier's bank details have changed. It usually arrives by email and is a form of business email compromise.
How can I tell if an invoice email is a scam?
Look for a change of bank details, a sender or reply-to address that differs slightly from usual, pressure to pay quickly or keep it confidential, and a first-time or unusual payee. Verify any change using contact details you already hold before paying.
Can email security stop invoice fraud from a genuine supplier's account?
Sometimes. When a supplier's mailbox is compromised the email passes authentication, so only products that analyse relationships, language or writing style are likely to flag it. A verification process is still needed for the cases technology misses.
Who do I report invoice fraud to in the UK?
Contact your bank immediately, then report it to Report Fraud, which has replaced Action Fraud for England, Wales and Northern Ireland. In Scotland, report it to Police Scotland.
Does DMARC stop invoice fraud?
DMARC stops criminals sending invoices from your exact domain, which protects your customers. It does not stop lookalike domains or compromised supplier mailboxes, so it is one layer among several.
Still have a question about email protection against invoice fraud?
Ask us and a member of our team will reply by email.