Paid a fake invoice? What to do about vendor bank-change fraud

The email looks routine. A supplier you have paid for years writes to say their bank has changed and attaches a new invoice with fresh account details. The thread, the signature and the tone all look right. Your bookkeeper updates the vendor record and sends the payment. A week later the real supplier calls asking why they haven't been paid.

This is business email compromise, sometimes called payment redirection or vendor impersonation fraud, and it is one of the most costly scams aimed at small and mid-sized businesses. It rarely involves malware. It works because someone's mailbox, yours or the vendor's, was quietly taken over, or because a lookalike address was close enough to pass a quick glance. This guide covers what to do in the first hours if it has happened, how to work out where the breach was, and the controls that stop it next time.

The first hour: call the bank before anything else

Speed matters more than anything else here. Funds sent by fraud are usually moved on quickly, so every hour you wait makes recovery less likely.

1. Call your bank's fraud or wire department by phone. Don't rely on email or an online message. Tell them the payment was fraudulent, give the date, amount and receiving account, and ask them to request a recall or reversal and to contact the receiving bank. Write down the name of the person you spoke to and any reference number.
2. File a complaint with the FBI's Internet Crime Complaint Center at ic3.gov. Include the transaction details, the receiving bank and account, and the fraudulent email addresses. The FBI works with banks on these reports, and a fast report gives the best chance of the money being frozen.
3. Tell the real vendor, using a phone number you already had on file, not one from the recent emails. Their mailbox may be the one that was compromised, and their other customers may be getting the same messages.
4. Stop any other pending payments to the changed account details, and hold any vendor bank changes made recently until each one is checked by phone.
5. Notify your insurer if you carry cyber or crime coverage. Many policies have short reporting windows and specific terms for this kind of loss, so check the policy and call early.

Keep the fraudulent emails. Don't delete them or the thread they arrived in: the bank, the FBI, your insurer and your IT team will all want the original messages, including their full headers.

Work out whose mailbox was compromised

Once the payment side is in motion, find out how the attacker got into the conversation. There are three common patterns, and the fix depends on which one it was.

A lookalike domain

Look closely at the sender address on the fraudulent emails, not just the display name. Attackers register domains that differ by one character, swap a letter for a number, or add a word like "billing" or "inc". If the address is not the vendor's real domain, neither mailbox may have been breached; the attacker may simply have copied an old invoice. Still check both sides, because the attacker needed to know about the relationship from somewhere.

The vendor's mailbox

If the email came from the vendor's genuine address and their message history looks real, their account was probably taken over. That is their incident to fix, but you should tell them what you saw, treat all their emails with care until they confirm it's resolved, and verify any payment request by phone.

Your own mailbox

If the attacker replied inside your existing threads, or your staff never saw some of the messages, check your own accounts, starting with whoever handles accounts payable. In Microsoft 365, the usual signs are:

• Inbox rules that move, delete or mark as read any messages containing words like "invoice", "payment" or the vendor's name, so the real replies are hidden.
• Automatic forwarding to an outside address.
• Sign-ins from unfamiliar locations or devices in the sign-in logs, and new MFA methods added to the account.
• Connected apps the user doesn't recognize that were granted access to mail.

If you find any of these, reset the password, revoke all active sessions, remove unknown MFA methods, rules, forwarding and app consents, and review what else the account could reach. Signing the attacker out matters as much as changing the password, because a stolen session token can keep working after a reset. Our Microsoft 365 support covers this kind of tenant investigation and cleanup.

If the compromised mailbox held customer or employee personal information, talk to your attorney about whether any notification obligations apply.

The controls that actually stop it

Technology helps, but the single most effective defense against payment redirection is a simple process rule that everyone follows, every time.

Verify bank changes by phone, using a known number

Any request to change a vendor's bank details, or to send a payment somewhere new, gets confirmed by calling the vendor on a number already in your records, never one from the email asking for the change. Write this down as a policy and tell your vendors you follow it; most will appreciate it. The same applies to an "urgent" request from an executive to send money or buy gift cards.

Require two people for payment changes

Split the work so the person who updates vendor bank details is not the person who approves the payment, or require a second approval for any change to payee details and any payment above a level you set. Most banks and accounting systems support dual approval; turn it on.

Lock down email accounts

• Turn on multi-factor authentication for every account, starting with finance staff and anyone who can approve payments. Prefer an authenticator app or security key over text messages.
• Block automatic forwarding to external addresses unless there is a specific business reason for it.
• Turn on alerts for suspicious inbox rules and risky sign-ins, and make sure someone actually reads them.
• Tag emails from outside the organization so a message that pretends to be internal stands out.

Protect your own domain

Publish SPF, DKIM and DMARC records for your domain and move DMARC toward a policy that rejects spoofed mail. This stops criminals sending email that appears to come from your exact domain to your customers. It won't stop lookalike domains, which is why the phone-verification rule still matters.

Train the people who pay the bills

A short, specific briefing for accounts payable and office staff beats generic awareness videos. Show them a real example of a bank-change request, the lookalike address tricks, and what to do when something feels off: pause, and pick up the phone.

Where to get help

If you think a payment has gone to the wrong account, call your bank first, then get the mailbox investigated the same day. Our cybersecurity services team can help you find how the attacker got in, close the gap and put the controls above in place, and our managed IT services keep monitoring sign-ins and mailbox rules afterward, for businesses across Los Angeles County, Ventura County and the Inland Empire.