NexusSec.Short version: Invoice fraud works by persuading your finance team to send a genuine payment to a new account, usually through an email that appears to come from a real supplier. Stop it with process, not technology alone: verify every change of bank details by calling the supplier on a number you already had, require a second approver for changes and large payments, and check your own mailboxes for forwarding rules. If money has gone, call your bank at once.
The email looks routine. A supplier you have paid for years writes to say they have moved banks, attaches a letter on their letterhead, and asks that this month's invoice be paid to the new account. Nothing about it looks like an attack, which is exactly why it works.
How it usually happens
- The supplier's mailbox is compromised. The attacker reads real conversations, waits for an invoice to be due, and replies in the same thread from the supplier's genuine address. Every technical check passes because the email is real.
- A look-alike domain. The email comes from a domain one character different from the supplier's, or with a different ending. Busy readers do not notice.
- Your own mailbox is compromised. An attacker inside your finance mailbox can see invoices arrive, hide replies with rules, and correspond as you.
In all three, the request is plausible, the timing is right and the amount is expected. That is why the defence has to be a process that does not depend on spotting the fake.
The controls that stop it
- Verify every bank change by phone, on a number you already had. Not a number in the email or the letter. Call the person you normally deal with, using the number from your supplier records or an earlier contract.
- Two people for changes and large payments. One person updates bank details; a different person approves them, after the callback.
- Hold the first payment to a new account. Pay a small amount first or confirm receipt with the supplier before sending the full sum, where your process allows.
- Treat urgency as a warning sign. "Pay today or the shipment stops" and requests for secrecy are pressure tactics. A genuine supplier can wait for a callback.
- Write it down. A short, written payment procedure that staff are allowed to follow, even when the request seems to come from a director.
The technical side
- Enforce MFA on finance mailboxes, and block automatic forwarding to outside addresses. See Microsoft 365 security settings.
- Check finance mailboxes regularly for inbox rules that forward, move or delete mail.
- Publish SPF, DKIM and DMARC so nobody can send email as your own domain. This does not stop look-alike domains or a supplier's compromised mailbox, which is why the callback matters.
- Add a warning banner to email from outside the organisation, so a message that claims to be internal but is not stands out.
If money has already been sent
- Call your bank immediately and ask them to try to recall or freeze the payment. Speed matters more than anything else here.
- In India, report it to the national cybercrime helpline, 1930, and at cybercrime.gov.in.
- Tell the genuine supplier, by phone, so they can check their own mailbox and warn other customers.
- Check your own mailboxes for compromise, using the steps in the first hour after a phishing click, and tell your insurer if you have cover.
