Invoice fraud and fake bank details: five controls every business needs
A convincing email asks you to pay a supplier into a new account. With AI, the email, and even the voice on the phone, can now be faked. The defences are simple, and they work.
Payment diversion fraud is simple and effective. A fraudster gets into, or imitates, a supplier’s or director’s email and sends a request to pay into a new account. The invoice looks right, the timing is plausible, and the money is gone within hours. AI makes the emails more convincing and can now imitate a familiar voice on a call.
Five controls
- VerifyConfirm any change of bank details by phoning a number you already hold.
- WaitHold the first payment to new details until it is verified, however urgent it sounds.
- Two peopleRequire a second approver for new payees and unusual payments.
- Check the nameUse your bank’s Confirmation of Payee check, and stop if the name does not match.
- TrainTell staff that urgency and secrecy are the signs of a scam, and that no one will mind them checking.
If it happens
Call your bank immediately: the faster the report, the better the chance of recovering money. Report it to the police through Report Fraud, the UK’s service for reporting fraud and cyber crime, preserve the emails, and check whether your own email account was compromised, so suppliers and customers can be warned.
Fraudsters also target customers by pretending to be you. Tell your customers, in writing, that your bank details will never change by email.
More on
This insight is general information, not advice for your circumstances. Talk to us before acting on it.