Prevent Invoice Fraud: Verify Payments & Bank Changes

Invoice fraud attempts to divert a payment or obtain money for an obligation that is not genuine. It can involve a false supplier invoice, altered bank instructions, impersonation of an executive or a compromised email account. The invoice may look ordinary and use a real project name. Appearance alone is not enough to establish that the payee and payment details are correct.

Business email compromise can be especially convincing because the message may appear within an existing conversation or reference familiar people. Urgency, secrecy and a change in payment instructions are reasons to pause and verify. A fraud-control process should operate before money leaves the account, with a clear owner and an independent way to confirm material changes.

Do not verify a payment change by replying to the same message that requested it. Call a trusted contact using a number already held in the supplier record or independently confirmed through an established source. A telephone number supplied in the suspicious email may lead to the attacker. Record who verified the change, when and what evidence was used.

Use the same process even when the message appears to come from a senior person or a longstanding supplier. A claim of urgency should not bypass the control. If the usual contact is unavailable, escalate under the company's policy rather than accepting a substitute chosen by the requester. Explain this process to genuine suppliers so verification is an expected business practice.

Confirm the supplier, purchase order or agreement, delivery evidence, amount, currency and payment terms. Look for duplicate invoice numbers and unexpected changes in the beneficiary name. A genuine-looking invoice may still duplicate a payment already made or include work that was never approved. Reconcile against the company's records before deciding that a familiar logo makes it safe.

For services without a formal purchase order, establish another documented approval basis. The person requesting work should confirm the scope and acceptance, while the payment reviewer checks details and prior payments. Avoid a process where one person can create a supplier, approve the invoice and release a material payment without any independent check.

Where practical, use separate people for preparing and authorizing high-risk payments. Set limits and define which changes require a second approval. A small company can still require an independent callback for new bank details and a documented review for large transfers. The control should be specific enough to follow during a busy day.

Keep a record of approved beneficiary details and restrict who can edit them. Review changes periodically and remove access when responsibilities change. Shared banking credentials make it harder to identify who acted and weaken accountability. Use individual permissions and authentication supported by the institution, with a process for temporary absence rather than passing credentials between staff.

Use multifactor authentication, strong unique passwords and appropriate device security for email, accounting and banking systems. Train staff to inspect sender addresses and avoid opening unexpected attachments or signing in through unfamiliar links. These measures reduce exposure but do not eliminate the need to verify a payment request independently.

If an email account may be compromised, review recovery settings, forwarding rules and active sessions through an authorized process. Involve the relevant technical support and preserve useful evidence. Simply changing a password may not resolve every access path. Keep the investigation proportionate and avoid sending sensitive records to an unverified person claiming to help.

Imagine a $25,000 supplier invoice arrives with a note that the supplier changed banks. The invoice number and project are familiar. The payment preparer compares the amount with the approved work, notices the new beneficiary details and calls the established supplier contact. The supplier confirms no change was requested. Payment remains on hold while the company investigates the message and verifies the legitimate invoice.

The successful control in this example is not spotting a spelling mistake. It is using a known channel that the attacker did not choose. A process depending on obvious errors will fail against a polished message. Test the workflow with a safe internal exercise and check whether staff know whom to contact when the usual approver is unavailable.

Contact the financial institution immediately through its official channel and explain that the transfer may be fraudulent. Ask about the available recall or recovery process. Preserve the invoice, messages, payment details and timestamps without altering the original evidence. Prompt action can matter, but recovery is not guaranteed and should not be promised to colleagues or customers.

Report the incident through the appropriate authorities, including the FBI's Internet Crime Complaint Center where applicable, and follow the business's legal, insurance and incident-response requirements. Assess whether accounts or personal data were compromised and obtain qualified help for notification obligations. Do not communicate with a supposed recovery service merely because it claims to have located the funds.

The policy should define approved supplier records, payment-change verification, approval limits, evidence retention and incident escalation. Give staff a short checklist that fits the actual payment workflow. A long policy stored away from the accounting process is less useful than a clear control applied consistently to each material change.

The worksheet below provides a verification log and incident-preparation record. Use fictitious details when practicing and keep real bank and personal information in the company's protected systems. Review the process after changes in staff, banking tools or supplier volume. The objective is a reliable pause-and-verify habit, not a claim that software or training can make fraud impossible.