Invoice Fraud: What to Do If Your Business Paid a Fake Supplier Invoice

Your company gets an email from a supplier you've paid for years, with their usual signature, their usual way of writing and this month's invoice attached, but this time they ask you to pay into a new account because they've changed banks. It looks like the same supplier as always, so accounts goes ahead and pays. A week later the real supplier gets in touch asking where their money is, but by then it's already sitting in the fraudster's account. It's almost impossible for your team to spot, because the criminals have usually been reading the emails before they strike. This is invoice fraud, and it catches out well-run small businesses every day. Most of the time they pose as a supplier, but the same trick can also arrive as a customer, or as an employee asking to change the account their salary is paid into. If you're reading this with a knot in your stomach, take a breath: there's a lot you can do today, and when you act quickly the money is often recovered.

If you run the business, handle the finances or the books, or look after IT, we'll walk you through how the scam works, what to do in the first hours, where to report it and how to stop it happening again.

In this article

1. How invoice fraud and business email compromise work
2. Red flags of a fake change of bank details
3. The first hours: what to do if you've already paid
4. Report it and notify the right people
5. Who carries the loss: you, the supplier or the bank?
6. How to prevent invoice fraud and fake bank detail changes
7. When to get professional help

How invoice fraud and business email compromise work

Invoice fraud is one of the most common forms of business email compromise (BEC), also called payment diversion fraud or mandate fraud. UK police describe it simply: criminals contact a business, usually pretending to be a company it already deals with, and either request a payment or announce a change of bank details. They often use email addresses that look almost identical to the real one.

It's convincing because it doesn't come out of nowhere. The FBI explains that BEC often starts with a compromised email account, through social engineering or a computer intrusion. Criminals may read emails for a while before acting, so they know which invoices are due and how your supplier writes. Typically:

• Your mailbox was compromised. They set up a hidden rule that forwards the supplier's emails elsewhere, then write to you from a lookalike domain.
• The supplier's mailbox was compromised. The fake email comes from their real address. This is the hardest to spot.
• The address is spoofed without anyone being hacked, using details from your website, social media or old data leaks.

The scale is huge. The FBI's IC3 recorded more than $55 billion in exposed losses from BEC worldwide between October 2013 and December 2023. That's not meant to scare you. It's a reminder that this happens to careful businesses too.

A close cousin is CEO fraud, where criminals pose as one of your own executives and ask for an urgent transfer. The first steps after paying are the same as below.

Red flags of a fake change of bank details

No single sign proves fraud, but a few together are a reason to stop and check:

• A request to change a regular supplier's bank details by email, "because of an audit", "a new bank" or "a problem with the old account".
• The sender looks right but isn't. Check the full email address, not just the display name.
• Pressure or secrecy: "it must be paid today", "I'm travelling, email only".
• The new account is abroad or with a bank that doesn't fit a supplier who has always been paid the same way.
• Your bank's name check doesn't match. In the UK, Confirmation of Payee tells you if the account name doesn't match. Take that warning seriously.
• Small changes to the invoice: a slightly different layout, a number out of sequence, a different font.

If this slipped past your team, please don't blame them. These emails arrive exactly when you're expecting that invoice, and they're very well made.

The first hours: what to do if you've already paid

Order matters and time counts. Do this now, even before you know how they got in:

1. Call your bank on its official number or your relationship manager. Say it's fraud, give the amount, date and receiving account, and ask them to recall the funds from the receiving bank and ask for them to be frozen. The FBI advises requesting a recall immediately, along with any indemnification documents the bank needs. Get a reference number and confirm it in writing.
2. Call the supplier on a number you already had. You'll find out whether their email is compromised, and they can warn other customers.
3. Delete nothing. Save the fake email in its original format (.eml or .msg, so the headers are kept), the invoice, the payment confirmation and the earlier thread.
4. Lock down email. Change the password from a trusted device, turn on two-step verification and check for forwarding rules or filters you didn't create, new users or odd sign-ins. The NCSC's first advice is to tell your IT team or provider as soon as you can.
5. Check other pending payments to that supplier and to anyone else who asked to change bank details recently.

Can you recover a wire transfer lost to fraud?

Often, yes, especially when you act in the first hours. A completed transfer can't be undone with a button, but if the money is still in the receiving account, that bank can hold it, and a fast report helps it get frozen.

In the US, file a complaint at ic3.gov as soon as possible, whatever the amount. According to the FBI, IC3 may be able to help banks and law enforcement freeze the funds. There's no general refund scheme for transfers a business authorized, but ask your bank in writing anyway: policies vary.

In the UK, since 7 October 2024 the APP fraud reimbursement rules cover individuals, microenterprises and charities for Faster Payments and CHAPS, up to £85,000, and claims should be made within 13 months. If you're a very small business, ask your bank whether you qualify. Larger companies aren't covered by the scheme, but the bank should still try to recover the money.

For a broader look at how payments can be clawed back, see how to get money back after being scammed.

Report it and notify the right people

Report to the police

• US: file with the FBI's IC3. Include the receiving bank, account number, amount and dates, and attach the emails if you can.
• UK: report to Report Fraud online or on 0300 123 2040 (in Scotland, call 101). You can also report a cyber incident to the NCSC.

Gather the fake and genuine emails with full addresses, the invoice, the payment confirmation, a short timeline (when the email arrived, who processed it, when you paid, when you noticed) and the bank's reference number. Send the crime reference to your bank: it helps them push for a freeze. Our guide on how to report a scam walks through each step.

If personal data was exposed

If criminals were inside your company email, they probably saw personal data of customers, staff or suppliers. That's a personal data breach. In the UK, a notifiable breach must be reported to the ICO within 72 hours of becoming aware of it, and people must be told if the risk to them is high. In the US, it depends on each state's breach-notification law. It sounds heavy, but reporting promptly shows you acted responsibly. Whatever you decide, document what happened and what you did.

Who carries the loss: you, the supplier or the bank?

It's the big question, and the honest answer is that it depends on where the breach happened. In general, if the money never reached the supplier, the invoice may still be unpaid. But other things matter:

• If the supplier's mailbox was hacked and they didn't warn customers or lacked reasonable security, there may be room to negotiate or claim against them.
• If the bank made mistakes, such as ignoring very clear warning signs, there may be grounds for a complaint.
• Check your insurance. Some cyber or crime policies cover social engineering fraud. Read the small print and notify the insurer early: there are usually deadlines.

Before paying the invoice twice or ending the relationship, have a lawyer look at the emails and the contract. There are often more options than it first seems.

Imagine a distributor that pays $20,000 into a supplier's "new account" and finds out the next morning, when the supplier chases the invoice. If they call the bank within the hour, file with IC3 that morning and send the reference to the bank, there's a good chance the money is still in the receiving account and the receiving bank can hold it. That's why speed makes such a difference.

How to prevent invoice fraud and fake bank detail changes

The good news is that simple habits stop most invoice fraud, and they're the same ones the FBI, UK police and the NCSC recommend:

• Don't change anyone's bank details without first picking up the phone and calling the supplier or the person who owns that email, on a number you already had and with someone you know, never the number in the email and never by replying to it.
• Use name checks. In the UK, take Confirmation of Payee warnings seriously. For large amounts, send a small test payment first and confirm it arrived.
• Two-person approval for new suppliers, bank detail changes and payments above a set amount. Only designated staff should be able to change payment details.
• Protect email: two-step verification on every account, unique passwords and regular checks for forwarding rules. Ask whoever manages your domain to set up SPF, DKIM and DMARC, which make it harder for others to send email in your name.
• Train your finance team. Five minutes a quarter reviewing these red flags saves a lot of grief.

When to get professional help

If the amount is large, if the bank can't freeze the funds, if you don't know how they got in, or if the supplier insists you pay again, get a professional view as soon as possible. A digital forensics expert can analyse the mailbox and headers to find out which account was compromised, and a lawyer can push for measures to freeze the receiving account and claim against whoever is responsible.

We are lawyers and expert investigators specializing in online scams, cryptocurrency and cybercrime. Every case is always handled by a lawyer or an expert investigator. Send us the invoice, the fake email and the payment confirmation, even if it's all a mess: we'll review it for free and tell you what to ask your bank for today and what to do next. In many cases the money is recovered, especially when you act fast. At Kironic we do everything we can to recover your money.

One last warning: after a fraud like this, "recovery firms" sometimes get in touch guaranteeing 100% back for an upfront fee. That's usually a second scam. Here's how to tell if a recovery service is legit.