How to stop vendor invoice fraud and payment redirection

Payment redirection fraud doesn't need malware. It needs one believable email that says your supplier's bank details have changed, and one person who updates the record without checking. This guide covers how vendor invoice fraud works, the red flags, a call-back procedure that stops it, and what to do in the first hours if money has already gone.

What is vendor invoice fraud?

Vendor invoice fraud is a form of business email compromise (BEC). The FBI's Internet Crime Complaint Center defines BEC as "a scam targeting businesses or individuals working with suppliers and/or businesses regularly performing wire transfer payments," carried out by compromising email accounts and other communications "to conduct unauthorized transfer of funds" (2025 IC3 Annual Report).

In a payment redirection scam, the criminal poses as a supplier you already pay. The goods or services are real. The invoice may be real. Only the bank account is new.

It shows up in a few forms:

The last row is a related scam the FTC warns small businesses about. Scammers "send fake invoices to businesses for products or services they never ordered," sometimes posing as a well-known company, and some are "really a phishing scam designed to get access to your business's data and networks" (FTC, May 2026). Our guide to fake invoice and payment emails covers renewal, domain and SEO invoice scams.

How much money is at stake?

BEC as a whole is one of the costliest crimes reported to the FBI. The 2025 IC3 Annual Report recorded 24,768 BEC complaints with $3,046,598,558 in reported losses. An IC3 public service announcement put exposed BEC losses at $55,499,915,582 between October 2013 and December 2023. These are reported cases only, and they cover all BEC, not just supplier fraud. For the wider picture, see our business email compromise prevention guide and our sourced phishing statistics roundup.

How does a payment redirection attack work?

1. Access or impersonation. The criminal either breaks into a mailbox at the supplier (or at your company) or sets up a lookalike domain.
2. Watching. With mailbox access, they read invoices and payment schedules and learn who approves what. They may add inbox rules to hide replies from the real owner.
3. The switch. Just before a payment is due, they send new bank details, often on a convincing letterhead or as an edited PDF invoice.
4. Pressure. "Our old account is frozen for an audit." "Please pay today to avoid late fees." "I'm traveling, email only."
5. Cash-out. Money lands in a mule account and is moved on, sometimes abroad.

If the email comes from the supplier's real, compromised mailbox, it can pass SPF, DKIM and DMARC. That's why the process controls below matter more than any single technical check.

What are the red flags of a fake bank detail change?

Train everyone who touches payables to stop and verify when they see any of these:

• Any change to bank details, however routine it sounds. This alone is enough to trigger a call-back.
• A new account in a different name, region or country from the supplier.
• Urgency or secrecy: a deadline, a threat of late fees, "don't call, I'm in meetings."
• A changed reply-to address, or a sender domain that's slightly off. The IC3 advises you to "verify the email address used to send emails, especially when using a mobile or handheld device" (IC3 PSA).
• Odd timing: a request just before a large or end-of-month payment.
• Small changes in tone or formatting from a contact you know well.
• An invoice for something nobody ordered. The FTC tells businesses to "check all invoices closely."

What call-back procedure stops payment redirection?

The IC3's first prevention tip is to "use secondary channels and/or two-factor authentication to verify requests for changes in account information." The UK NCSC recommends "ensuring that all important email requests are verified using a second type of communication," and that staff are "familiar with the normal ways of working for key tasks" such as how payments are made (NCSC).

Turn that into a written procedure that applies to everyone, including owners and partners.

The bank detail change procedure

1. Freeze the request. Don't update the vendor record or pay anything to the new account yet.
2. Find the number yourself. Use the phone number in your vendor master file, the original contract or the supplier's official website. Never use a number, link or contact from the email or invoice that asked for the change.
3. Call a person you know. Ask them to confirm the old account, the new account and why it changed. If you reach someone you don't know, call back through the main switchboard.
4. Don't accept a call-back from them. An inbound call "confirming" the change could be the criminal.
5. Get a second approver. A different person signs off the change in the vendor record. They check that steps 2 to 4 happened.
6. Record the check. Log the date, the number you called, who you spoke to and who approved it.
7. Test with a cooling-off period. Where you can, hold the first payment to a changed account for a short period, or confirm receipt of a small first payment with the supplier by phone before sending the rest.
8. Watch the next payment. Ask the supplier to confirm receipt. If they say they haven't been paid, start the incident steps below at once.

Tell your suppliers and customers how you work

Fraud runs both ways: criminals impersonate your suppliers to you, and impersonate you to your customers. The NCSC suggests telling suppliers and customers what to expect, for example that "our bank details will not change at any point." Put a line in your invoice footer and onboarding packs saying you'll never change bank details by email alone, and that customers should call you on a known number before paying a new account.

Tighten vendor master file controls

The FTC advises making sure "your company's procedures are clear for approving purchases and invoices from vendors you actually work with." In practice:

• Separate duties: the person who changes bank details shouldn't be the one who releases payments.
• Restrict who can edit the vendor master file, and review changes weekly.
• Flag any payment to an account changed in the last 30 days, or whatever window suits you, for extra review.

Which email controls reduce invoice fraud?

Process stops most attacks. These controls shrink how many reach your team.

Protect your own domain with DMARC

If your domain has no enforced DMARC policy, criminals can send invoices that appear to come from your exact address. The NCSC notes DMARC "stops phishers from spoofing your domain." Move to p=quarantine or p=reject in stages using our DMARC p=none to p=reject guide, and check where you stand with the DMARC Checker. Our October 2026 scan of the Tranco top 1,000 found 38.3% of domains didn't enforce DMARC. You can draft a policy with the DMARC Generator.

Catch lookalike domains

DMARC can't help when the criminal registers examp1e-supplies.com instead of example-supplies.com. Inbound filtering with impersonation checks, external sender tags and first-contact warnings help here. Our guide to lookalike domain phishing explains the techniques and defenses.

Secure the mailboxes that handle money

Account takeover is how criminals find invoices to copy. CISA's phishing guidance recommends MFA and prioritizes phishing-resistant MFA for privileged accounts. Start with accounts payable, finance and leadership, and review their mailboxes for unexpected forwarding or inbox rules.

Make reporting easy

CISA encourages organizations to use the reporting features built into Outlook and other cloud email platforms. A quick report from one clerk lets you warn everyone else before the next payment run.

What should you do if money has already been sent?

Time decides whether money comes back. The FBI's guidance in the 2025 IC3 report is direct: "If you discover a fraudulent transfer, time is of the essence."

1. Call your bank now. Ask it to "request a recall of the funds along with any necessary indemnification documents." Ask what help it can give; the IC3 notes that "different financial institutions have varying policies."
2. File a complaint at ic3.gov. Do it "regardless of the amount lost," and include the full transaction details. The IC3 says it "may be able to assist both the financial institutions and law enforcement in freezing funds."
3. Call the real supplier on a known number. Their mailbox may be compromised, and other customers may be targeted.
4. Secure your own mailboxes. Reset passwords, revoke sessions and check inbox rules for anyone involved. Our guide on what to do after a phishing click has the full checklist.
5. Preserve evidence. Keep the original emails with full headers, the invoice and payment records. The Email Header Analyzer shows which server really sent the message.
6. Tell your insurer if you have cyber or crime cover.

How the IC3 Recovery Asset Team helps

The IC3 Recovery Asset Team (RAT) was established in 2018 and works with banks through the Financial Fraud Kill Chain (FFKC) to freeze fraudulent transfers. In 2025 it initiated 3,900 FFKC incidents across all fraud types, with $1,163,919,846 in attempted theft and $679,013,183 frozen, a 58% success rate (2025 IC3 Annual Report).

The same report describes a city government office in Oregon that lost over $6 million to a BEC wire. The recipient account had already been flagged and frozen through the FFKC after an earlier victim's complaint. So the recipient bank contacted the sending bank to confirm the wire instructions, they were found to be fraudulent, and the originating bank was able to issue a recall. Reporting quickly helps the next victim, too.

Invoice fraud prevention checklist

Next steps

1. Write the eight-step bank detail change procedure into your payables process this week, and walk every approver through it.
2. Add a "we never change bank details by email" line to your invoices.
3. Check your domain with the free Email Health Check and fix any gaps in SPF, DKIM or DMARC.
4. Put your bank's fraud number and the ic3.gov link in your incident plan. For domain-level inbound filtering with phishing and spoofing protection in front of your existing mailboxes, see how iBlockSpam works.

If attackers register a look-alike of your own domain to fool your customers, iBlockSpam's Lookalike Domain Watch can alert you when it appears, so you can warn them.

Browse our other phishing and threat guides.