Bank detail change verification process for invoice fraud

The typical attack is a request, by email or on a new invoice, to pay a supplier into a different bank account. The message may come from a spoofed address, from the supplier's genuinely compromised mailbox, or from someone posing as a senior colleague. Appearance proves nothing, because logos and wording are easily copied.

The control therefore assumes every change is unverified, including those from long-standing suppliers and those marked urgent. Urgency is itself a warning sign, so the written process should say that pressure to pay quickly is a reason to slow down and hold the payment.

When a change request arrives, the person who receives it must not update the supplier master record. They log the request and place any outstanding invoices from that supplier on hold. The held status stops a busy week from turning a pending query into a paid invoice.

The verifier phones the supplier on a number taken from your own records, such as a previous genuine invoice, the contract or an earlier payment file. A number in the change request, the email signature or the new invoice does not count, because the attacker controls it.

Speak to a known contact and ask them to confirm the new sort code, account number and account name. If the supplier cannot be reached on trusted details, the payment stays on hold and the matter goes to a director. Do not accept a reply by email as confirmation, since the mailbox may be the compromised channel.

A second person approves the change before the master record is amended. They should not be the person who received the request or who will release the payment. In a firm with few staff, a director or another colleague acts as the independent checker.

The approver also compares the invoice with a previous genuine one, checking supplier name, amount, reference and payment details. Apply the same checks to new suppliers and to urgent or unusually large payments, not only to changes.

An assessor or insurer will ask for proof that the control operated, not just a policy document. Each change should leave a record that shows who did what, when and by which method, and it should be held with the supplier record so it can be found quickly.

Someone independent of payments should also review bank statements periodically for unexpected payees or amounts. That review catches changes that bypassed the process.

Contact your bank immediately using its official contact details, not those in any email, and ask it to attempt to recall the payment. Keep the emails, invoices and call records, as the bank and the police will want them.

Tell your IT contact or the person responsible for email security, because the supplier's or your own mailbox may be compromised. Pause any other pending changes from that supplier until you have verified them by phone.