What is invoice fraud?
Invoice fraud can involve a fabricated bill, an altered genuine invoice or an email that diverts a legitimate payment to different bank details. Supplier impersonation can use a lookalike domain, a forged display name or a compromised real mailbox. A professional-looking document is not proof that payment instructions are authorized.
Compare the instruction with a verified previous transaction. Changed bank details, an unexpected Reply-To address or unusual urgency are reasons to verify, not conclusive proof of fraud. Do not assume an unchanged email address makes a request legitimate.
Verify independently before paying
Call the supplier using a number already held in a trusted record, rather than a new number supplied in the payment-change email. Require separate approval for bank-detail changes where possible and document the verification.
If payment has already occurred, contact the sending bank promptly. Preserve transaction references, time, amount and communications. Follow local reporting procedures; no private recovery service can guarantee that funds will be returned.
Preserve a comparison set
Keep the original invoice, revised versions, message thread and known-good supplier details. Original formats can preserve information lost in printouts or forwarded copies. File timestamps and metadata require context and should not be treated as independently reliable proof.
- Save genuine and suspicious invoices without changing originals.
- Preserve original email headers and attachments.
- Record bank notifications and recall requests securely.
- Document supplier verification and payment approvals.
- Ask authorized administrators to preserve relevant mailbox rules and access logs.
Build a defensible timeline
Record when the bank-detail change arrived, who approved it and when the transfer occurred. Link material conclusions to artifacts. A DNS query made after the incident describes that later moment, not necessarily the historical configuration.
Use redacted working copies for wider circulation. Keep bank details and personal information in controlled evidence storage only where necessary and lawful.