Glossary · Payment methods
Invoice fraud
Also called Mandate fraud, Invoice redirection fraud, Business email compromise
Invoice fraud is when criminals pose as a supplier and trick a customer into paying a genuine invoice into the fraudster’s bank account.
In the most common version, a fraudster gains access to, or imitates, a supplier’s email and tells the customer that the bank details have changed. The customer’s next payment goes to the fraudster. The supplier is still unpaid and often finds out only when chasing.
Customers who have been targeted, or warned, become cautious about any change in bank details — which is right, and means suppliers must make legitimate changes verifiable: announce them well in advance, and invite customers to confirm by phone on a number they already have.
When chasing, never respond to a customer’s “we already paid” by assuming they are lying. Ask for the payment details. If they paid a different account, it is a fraud to report immediately to both banks, because speed decides whether the money can be recovered.
Example
A customer receives an email that looks like it is from its supplier, asking that future payments go to a new account. It pays €22,000 there. The fraud surfaces when the real supplier sends a reminder two weeks later.