Invoice Fraud Email: Spot False Invoices and IBANs

A safe verification process before opening or paying

Use the same process for every new supplier, bank-account change and unusual payment request. Consistency matters more than instinct.

1. 1Pause: do not open, reply, click or pay while the request is unverified.
2. 2Inspect the sender address, wording, attachment and requested change.
3. 3Verify the supplier independently using a trusted phone number or portal.
4. 4Compare the IBAN with approved records or a previously verified document.
5. 5Report the message, record the check and pay only after approval.

1. Pause the payment

Put the invoice aside without deleting it. Do not reply to the message to ask whether the new IBAN is correct. If the mailbox or thread is compromised, your reply may go to the attacker.

Tell the person who approves payments that the request is being checked. A simple internal rule can help: no bank-account change is paid on the basis of email alone.

2. Inspect the request

Read the full sender address and inspect the message for pressure, unusual wording and changes in normal procedure. Check whether the invoice matches a purchase order or expected delivery.

If the attachment is unexpected, avoid opening it until it has been checked. Save the original message where your business can preserve its details. Do not forward a suspicious attachment to colleagues casually.

3. Contact the supplier independently

Use a phone number from your supplier database, contract, previous verified invoice or the supplier’s official website. Do not use the number in the suspicious email or document.

Explain that you received a request to change bank details and ask the supplier to confirm the account through a trusted channel. You can also sign in to the supplier’s established customer portal by typing its known address yourself, rather than using a link in the email.

For higher-risk payments, use two separate checks. For example, one employee can call the supplier, while another compares the account with approved records.

4. Compare the IBAN

Check the proposed IBAN against the last verified account in your accounting system or supplier master record. Compare the account holder and country as well as the characters of the IBAN.

An IBAN that looks plausible can still be fraudulent. A matching company name is useful but not sufficient if the account change itself has not been confirmed.

Do not “test” a new account with a small payment unless your bank and supplier have an agreed process for doing so. A small payment can still be lost, and it may create confusion about which account is approved.

5. Record the result

Write down who confirmed the change, when they confirmed it and which trusted contact method they used. Update supplier records only after the check is complete.

If the request is fraudulent, mark it for your internal incident process. Your bank, IT provider or relevant reporting authority may need the original email, attachment, headers, payment instructions and timeline.

In the UK, the ICO’s guidance and resources can help organisations consider personal-data responsibilities after a security incident. Reporting and notification duties depend on what happened, what data was involved and the applicable law. In the EU, organisations should also consider their GDPR incident procedures and the relevant supervisory authority.

What to do when an attachment or payment request feels suspicious

If you have not opened the attachment, do not open it to investigate. Keep the original message and ask your IT or security contact to assess it. You can also contact the supplier through a known channel without forwarding the suspicious file.

If you opened the attachment but did not enter credentials or approve a payment, disconnect from sensitive work if your IT process tells you to do so. Close the file, avoid enabling macros or other active content, and contact your IT support team.

If you entered a password, change it from a trusted device and report the event internally. If the password is reused elsewhere, change it there too. Your organisation may also need to review sign-in activity and enable stronger account protections. For Mailamber accounts, two-step verification adds an extra sign-in check.

If money has already been sent, contact your bank immediately. Ask whether the payment can be stopped or recalled and provide the bank with the destination account, amount, time and payment reference. Contact the genuine supplier using an independent channel, preserve all evidence and follow your local reporting process.

Do not delete the email because it is embarrassing. Evidence can help your bank, IT provider, insurer or law-enforcement agency understand the route of the fraud.

For a small business, it is useful to document a short payment policy. Include who can approve invoices, how bank changes are confirmed, which records are trusted and what happens after a suspected incident. You can keep the policy to one page and review it with anyone who handles payments.

Worked example: checking a changed bank account

Greenfield Design Studio receives an email from “Maya at Northbridge Office Supplies”. The conversation looks familiar because the sender uses the same logo and refers to the studio’s recent order.

The attached invoice is for €2,480. The message says Northbridge has changed banks and asks Greenfield to pay the amount to a new IBAN before Friday. It also says, “Please do not call the accounts team as they are in an audit.”

Greenfield’s office manager, Daniel Reed, does not reply. He checks the complete sender address and notices that the domain is northbridge-office.com, while earlier verified invoices use northbridgeofficesupplies.co.uk. The difference is easy to miss.

Daniel checks the supplier record in the accounting system. The old IBAN is different from the one on the new invoice. He then calls the phone number stored in the supplier record, not the number in the email.

The supplier confirms that it has not changed its bank account and that its mailbox was recently accessed by an unauthorised person. Greenfield does not pay the invoice. Daniel saves the original message, reports it to the internal contact, informs the supplier and asks the bank whether any further action is needed.

The important decision was not spotting a perfect technical clue. It was refusing to let the email verify itself. The message, attachment and new IBAN were all treated as untrusted until the supplier was contacted independently.

Common mistakes that make invoice fraud easier

Trusting a familiar email thread

A real thread can contain a fraudulent reply. Start a new contact through a trusted number or portal when payment details change.

Calling the number in the message

An attacker can provide a convincing phone number. Use the number already held in your supplier records or obtained from a known official source.

Checking only the invoice total

The amount may be correct while the account is false. Compare the legal supplier identity and bank details, not just the price.

Opening the attachment to “see what it says”

The document may contain malicious content or may simply make a false request look official. Check the request first and use your organisation’s attachment-safety process.

Treating a small difference as harmless

A one-character domain change or a similar company name can be enough to misdirect a payment. Stop when details do not match.

Updating the supplier record too quickly

Changing the approved IBAN before confirmation can make later invoices appear normal. Record the old and proposed details until the independent check is complete.

Relying on one person’s memory

Payment checks should be written down. A short record reduces the chance that a busy colleague will approve the same request later.

Assuming security tools verify the payee

Antivirus scanning, spam filters and sender checks are useful layers. They do not prove that the bank account belongs to the supplier. The independent contact step remains essential.

FAQ

Is invoice fraud the same as phishing?

They overlap, but they are not identical. Phishing usually tries to steal information or access, while invoice fraud focuses on redirecting a legitimate business payment; an attack can involve both.

Can a valid-looking PDF contain a false IBAN?

Yes. A PDF can be edited, replaced or created by an attacker. Treat the payment details as untrusted until they are compared with trusted records and confirmed independently with the supplier.

Should we pay an invoice if the email address is correct?

Not automatically. A genuine mailbox may have been compromised, and an attacker may have entered a real conversation. A change to bank details should still be confirmed through a separate, trusted channel.

What should we do if we already paid the wrong account?

Contact your bank immediately and ask about stopping or recalling the payment. Notify the genuine supplier, preserve the email and invoice, and follow your business’s incident and reporting procedures.

Does scanning an attachment prove that the invoice is genuine?

No. A scan can help detect malicious files, but it cannot confirm the supplier’s identity or the ownership of an IBAN. Use attachment scanning together with independent supplier verification.