Fake invoices and compromised business email: verify changed bank details and respond after payment
A scammer can impersonate a supplier, take over their genuine mailbox or insert themselves into an existing conversation. They then send an altered invoice, announce new bank details or demand an urgent payment.
What happened?
Choose the closest situation. Stop further payments and preserve the original communication.
A suspicious invoice arrived
The invoice, attachment, amount or request does not fit your usual business dealings.
See the steps →A supplier announced new bank details
The change arrived by email or appears on a revised invoice.
See the steps →We already sent the payment
Funds went to a new, unfamiliar or fraudulently substituted account.
See urgent steps →We discovered a compromised mailbox
There are unfamiliar sign-ins, forwarding rules or fraudulent messages.
Secure the account →A fraudulent email need not come from an unfamiliar address
The attacker may use a lookalike domain, spoof sender details, compromise a genuine mailbox or impersonate management.
Lookalike email address
The domain contains a typo, extra hyphen, different ending or similar-looking character. Illustrative addresses below are not real suppliers.
accounts@supplier.exampleaccounts@supp1ier.exampleSpoofed sender
The display name or From field resembles a genuine company, but the message did not originate in its mailbox.
Compromised genuine mailbox
The attacker controls a real account, so messages can use the correct address and continue a genuine thread.
CEO fraud
The scammer impersonates a director or manager and demands an urgent, confidential or unusual payment.
How invoice and business-email fraud develops
The attacker may watch a conversation and intervene when a real invoice or payment is expected.
Identifying the business and partners
The attacker learns who approves payments and who the business trades with.
Impersonating or taking over email
They create a lookalike domain or gain access to a real mailbox.
Watching communication
They wait for an order, invoice, due date or suitable transfer.
Changing payment details
They send a revised invoice or announce a new supplier account.
Payment to the attacker
An employee believes they are paying the genuine partner.
Rapid movement of funds
The money is transferred onward, withdrawn or split across accounts.
How the fraudulent payment is explained
The pretext explains new bank details, urgency or bypassing the normal approval process.
Supplier account change
“Please send payments to our new account from this month.”
Revised invoice
“The previous document had incorrect payment details.”
Urgent instruction from management
“Send the payment today. This transaction is confidential.”
Replacement overseas account
“Our usual account is temporarily unavailable. Use this one.”
Fake lawyer or accountant
“The director authorised me to complete the transfer.”
Payment QR code on an altered invoice
The QR code contains the attacker’s account even though other details look correct.
What to check in the invoice and approval process
Compare the account, amount, currency, order and authorisation process.
Supplier account
Does it match approved records, the contract and previous invoices?
Expected change
Was the change independently known before the new invoice arrived?
Amount, currency and reference
Do they match the order and normal payment arrangements?
Normal approval process
Does the request bypass approval or accounting checks?
Independent second check
Did another responsible person verify the change through a trusted independent route?
Lower-risk invoice pattern
- Account matches verified records.
- Expected order and agreed amount.
- Expected currency, due date and payment reference.
- Normal approval process.
- No secrecy pressure. These checks reduce risk but are not a guarantee.
Suspicious invoice pattern
- New account without independent verification.
- Unexpected overseas or personal account.
- Sudden change of amount, currency or payee.
- Bypassing internal approval.
- Pressure for speed or secrecy.
Choose what has happened
Stop further payments, verify through another trusted channel and preserve the original email, invoice and records.
🧾 A suspicious invoice arrived
- Do not pay yet.
- Compare account, amount, currency and details with approved supplier records and previous invoices.
- Do not verify by replying to that email or using contact details on the new invoice.
- Reach the supplier on a previously verified number or another independent trusted channel.
- Preserve the original email, attachments and full headers; involve your finance team or IT.
🏦 A supplier announced new bank details
- Hold payments to the new account until independently verified.
- Do not confirm by replying to the message announcing the change.
- Call a previously verified number from existing supplier records or a known contract, not from the new invoice.
- Have a second responsible employee review and approve the change.
- Record who verified it and how.
🚨 We already sent the payment
- Contact your bank immediately and report suspected payment fraud.
- Ask about stopping or recalling the transfer and contacting the receiving bank. Recovery is not guaranteed.
- Contact the genuine supplier independently; notify your finance lead and IT/security team.
- Keep payment confirmation, recipient account, amount, time and all messages.
- Report suspected crime or loss to local police or the relevant reporting service.
🔐 We discovered a compromised mailbox
- Involve your IT administrator promptly. From a trusted device, change the password and revoke unauthorised sessions under the incident-response process.
- Enable or review multi-factor authentication and remove unfamiliar sign-in methods.
- Review forwarding, rules, filters, delegation and recovery information.
- Revoke unfamiliar app access, devices, tokens and permissions with the administrator.
- Review sent, deleted and archived mail. Warn affected colleagues and partners through trusted channels, coordinated with IT.
- Preserve sign-in logs and records of changes; IT should assess scope, other accounts and any reporting duties.
How to verify a supplier’s new bank account
Verify outside the email that announced the change. Use a contact the business independently trusted before the incident.
Hold the payment
Do not pay until the change is verified.
Avoid contact details in the message
Do not call a number from the new invoice, signature or suspicious email.
Call a previously verified number
Use approved supplier records or a trusted earlier contract. A website found through an advert may also be fake.
Require second approval
Record the change and have two responsible staff check it.
Urgency must not bypass payment safeguards
Skip normal approval
Urgency is not a reason to omit the second check.
Keep the transfer secret from colleagues
Secrecy can prevent independent verification.
Send without checking
Account changes require independent confirmation.
Do not call anyone
Instructions to use email only are a strong warning sign.
Split the payment
Smaller transfers may be used to evade internal limits.
Buy gift cards
Unexpected demands to email gift-card codes require independent verification.
Send sensitive business information
Verify requests for payroll or personal data through approved processes.
Disable security checks
Treat requests to disable MFA, filtering or approval safeguards as an escalation to IT, not a payment instruction.
When a payment request is risky
A combination of these signs means the payment must be held and verified outside the original conversation.
New bank account
The account changes just before payment is due.
Lookalike domain
A typo or different domain ending appears.
Different Reply-To address
Replies go somewhere other than the displayed sender.
Unexpected overseas or personal payee
The account does not fit the supplier or agreed arrangement.
Time pressure
Payment must happen before verification is possible.
Secrecy request
Accounting or colleagues must not know about the transfer.
Bypassing the process
The message demands an exception to approval.
Changed communication style
Unusual tone, signature or invoice delivery method.
A password change alone may not be enough
An attacker can add forwarding rules, recovery methods or connected apps that preserve access.
Unfamiliar sign-ins
Review history, devices, IP addresses and locations; locations alone do not prove compromise.
Automatic forwarding
Copies of mail may be sent to an attacker-controlled address.
Rules and filters
Messages may be moved, marked or deleted.
Recovery information
Review recovery phone, email and other recovery methods.
Connected applications
Have IT revoke unfamiliar apps, tokens and permissions.
Sent and deleted messages
Look for fraudulent invoices and account-change requests.
Processes that can stop an attack before payment
Combine MFA, verified callbacks and second approval; no single control guarantees safety.
Two-person account-change approval
One person verifies, another approves.
Verified callback
Use a previously verified number.
Approved supplier bank records
Keep approved account details outside ordinary email threads.
MFA for business email
Multi-factor authentication reduces takeover risk; phishing-resistant methods offer stronger protection.
Staff training
Finance staff and approvers should recognise BEC and CEO fraud.
Incident procedure
Everyone knows whom to contact after a suspicious payment.
What to keep
Preserve the original email, full headers, attachments and payment records safely.
Original email
The original message, full headers, time and Message-ID.
Sender and Reply-To
Display name, actual address and reply destination.
Attachment and invoice
Original document, payment QR code and changed details; do not reopen suspicious active content.
Conversation history
Previous messages and when the payment terms changed.
Payment details
Account, amount, currency, payee, time and confirmation.
Verification record
Who you contacted and what was confirmed.
Sign-ins and devices
Unfamiliar sessions, IP addresses, devices and times.
Settings changes
Forwarding, rules, recovery and connected apps.
Fake invoices and compromised email – FAQ
What is Business Email Compromise, or BEC?
Fraud using impersonated or compromised business email to redirect payments, steal money or obtain sensitive information.
Can an email from the correct address still be fraudulent?
Yes. A genuine mailbox may be compromised and the message may continue a real conversation.
How do we safely verify a new bank account?
Hold the payment and call a previously verified supplier number. Do not use the new invoice’s contact details. Obtain second approval.
What if the invoice details are correct?
Correct names, orders, amounts and signatures are not proof. The attacker may have accessed earlier communication.
What should we do immediately after payment?
Call the bank immediately and ask about stopping or recalling it. Notify the genuine supplier, your finance lead and IT, and report suspected crime to local police. Recovery is not guaranteed.
How can we check for mailbox compromise?
Have IT review sign-ins, sessions, forwarding, rules, recovery methods, app access and sent mail, and assess the wider incident.
Is changing the email password enough?
Not always. Revoke unauthorised sessions and app access, remove malicious rules, review recovery methods and MFA, and complete an administrator-led incident review.
Where should we report the incident?
Notify your bank if funds are involved, IT/email administrator, genuine business partner and local police or reporting service. DPP also accepts reports through its Czech form.
Found a fake invoice or compromised business conversation?
Preserve the original email, headers, invoice, recipient account and a short timeline. A DPP report does not replace contacting the bank, IT administrator or police.
Official recovery guidance
Australian Cyber Security Centre: Business email compromise (English)