Invoice fraud warning signs are easy to miss on a busy day, and the cost of missing one is high. A fake invoice or a faked change of bank details can send your money to a stranger in one transfer. This guide lists the signs and the simple habits that stop most of these scams.
How invoice fraud works
In invoice fraud, a criminal pretends to be a supplier, a boss or a partner. They send an email that looks real and ask you to pay money into a new account. The email may come from a hacked account, or from a look-alike address that differs by one letter.
The US FBI calls the wider scam business email compromise. Its 2020 report says it received 19,369 complaints about it that year, with adjusted losses of over $1.8 billion. The FBI says it was the costliest type of internet crime it tracked. The report also says the scam grew from fake emails from company chiefs to include hacked supplier accounts.
Asia is not safe from it. The Singapore Police Force said in May 2020 that it had received more than 100 reports of these scams between January and March 2020. Victims lost over S$9.2 million in those three months.
Six invoice fraud warning signs
Watch for these signs on any invoice or payment request.
- New bank details. A supplier you have paid before suddenly asks you to use a different account. This is a classic sign.
- Pressure to pay fast. The email says the payment is overdue, or that a deal will fail if you wait. Scammers want you to skip checks.
- A request for secrecy. A message that says "do not tell anyone" or "I am in a meeting, just pay it" should stop you.
- A small change in the sender. Look at the full email address, not only the display name. One extra letter or a different domain is a red flag.
- An unusual tone. Odd wording, a new signature or a change in how the person normally writes can mean someone else is typing.
- An invoice that does not match. The amount, the purchase order or the goods do not match your records.
One sign alone is not proof of fraud. Two or more together mean you should stop and check before you pay.
The call-back check
The best defence is a phone call. If an email asks you to change payment details, do not reply to it. Call the sender to confirm. The Singapore Police Force advised companies to verify changes to payment instructions and bank accounts by calling the person who sent the email.
Use a phone number you already have on file, such as one from a past contract or an earlier invoice. Do not use the number printed in the new email. If the email is fake, that number leads to the scammer.
Keep the call short and specific. Ask the supplier to read out the account name and the last four digits of the account number. Then match them to the invoice. Write down who you spoke to and when.
Build a two-person approval habit
A single person with the power to change bank details and send money is a risk. Split the job in two. One person enters or changes the payee details. A second person checks the change and approves the payment.
This works even for a small team. If you are the only finance person, ask the owner or a manager to be the second check. Make it a rule that nobody can approve a payment they set up themselves.
Set a lower limit for payments to new accounts. For example, hold any first payment to a new account until it has been confirmed by phone. A short delay costs little. A lost payment can cost a month of profit.
Lock down the inbox
Many scams begin with a hacked email account. Turn on two-step sign-in for every account that touches payments. Use a long, unique password for each one. Train staff to treat unexpected links and attachments with care.
The FBI report notes that criminals hack real business email accounts through social engineering or by breaking into systems. That means a message from a known address is not always safe. The call-back check still applies.
What to do if you paid the wrong account
Speed matters. Call your bank straight away and ask it to recall the transfer. Then report it to the police. The Singapore Police Force advised victims to contact their bank at once to try to recall the funds. Change the passwords on any email account that may have been hacked.
Afterwards, tell your suppliers and your team what happened. Add the warning sign that you missed to your checklist, so it is caught next time.
A quick checklist
- Never change bank details from an email alone.
- Call the supplier on a number you already hold.
- Have a second person approve every new payee.
- Check the full sender address on each invoice.
- Hold urgent, secret or unusual requests until they are confirmed.
- Report any loss to your bank and the police at once.
General information for finance teams, not legal or financial advice.
Sources
- FBI Internet Crime Complaint Center, 2020 Internet Crime Report
- Singapore Police Force, advisory on business email impersonation scam, 6 May 2020
- Cyber Security Agency of Singapore and Microsoft, Protecting Your Enterprise from Business Email Compromise Attacks, 11 June 2020