Invoice fraud is one of the simplest scams going around — and one of the most expensive. An attacker slips into an email thread (or spoofs a supplier) and quietly changes the bank details on an invoice. By the time anyone notices, the money is gone.
How the scam actually works
Most cases start with a compromised mailbox, not clever hacking. The criminal watches a real conversation, waits for an invoice to be sent, then emails a "small update to our banking details." It looks legitimate because it _is_ the real thread.
- The email address is often a near-match (one letter different)
- The tone and signature match previous messages
- There's usually mild urgency: "please update before end of month"
The one habit that stops it
Verify any change to payment details out of band — a quick phone call to a known number, never the number in the email. For your biggest suppliers, agree a simple rule: bank details never change over email without a call.
A five-minute phone call is cheaper than a six-figure mistake. If you'd like a hand putting a simple verification process in place, get in touch or take the 2-minute Risk Check.