# How to stop vendor invoice fraud and payment redirection

URL: https://iblockspam.com/blog/vendor-invoice-fraud-payment-redirection
Last updated: 2026-10-09
Published: 2026-10-09
Topic: Phishing & threats
Author: iBlockSpam Team

> How vendor invoice fraud and payment redirection scams work, the red flags, a call-back procedure for bank detail changes, and what to do if money was sent.

## Short answer

Vendor invoice fraud is when a criminal poses as a real supplier and asks you to pay into a new bank account. Never change payment details on an email alone: call the supplier on a number you already hold and require a second approver. If money has gone, call your bank for a recall and file at ic3.gov.

Payment redirection fraud doesn't need malware. It needs one believable email that says your supplier's bank details have changed, and one person who updates the record without checking. This guide covers how vendor invoice fraud works, the red flags, a call-back procedure that stops it, and what to do in the first hours if money has already gone.

## What is vendor invoice fraud?

Vendor invoice fraud is a form of business email compromise (BEC). The FBI's Internet Crime Complaint Center defines BEC as "a scam targeting businesses or individuals working with suppliers and/or businesses regularly performing wire transfer payments," carried out by compromising email accounts and other communications "to conduct unauthorized transfer of funds" ([2025 IC3 Annual Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)).

In a payment redirection scam, the criminal poses as a supplier you already pay. The goods or services are real. The invoice may be real. Only the bank account is new.

It shows up in a few forms:

| Variant | How it looks | Why it works |
|---|---|---|
| Bank detail change | "We've moved banks. Please update our details before the next payment." | It's a routine admin request |
| Hijacked thread | A reply inside a real email conversation about a real invoice | The context is genuine |
| Lookalike supplier domain | Mail from an address one letter off the supplier's real domain | Nobody reads the domain closely |
| Real estate or legal closing | New wire instructions just before a property closing | Large sums, tight deadlines |
| Fake invoice | A bill for goods or services you never ordered | Someone pays it without checking |

The last row is a related scam the FTC warns small businesses about. Scammers "send fake invoices to businesses for products or services they never ordered," sometimes posing as a well-known company, and some are "really a phishing scam designed to get access to your business's data and networks" ([FTC, May 2026](https://consumer.ftc.gov/consumer-alerts/2026/05/run-small-business-pay-your-bills-not-scammers)). Our guide to [fake invoice and payment emails](https://iblockspam.com/blog/fake-invoice-and-payment-emails) covers renewal, domain and SEO invoice scams.

## How much money is at stake?

BEC as a whole is one of the costliest crimes reported to the FBI. The [2025 IC3 Annual Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) recorded 24,768 BEC complaints with $3,046,598,558 in reported losses. An [IC3 public service announcement](https://www.ic3.gov/PSA/2024/PSA240911) put exposed BEC losses at $55,499,915,582 between October 2013 and December 2023. These are reported cases only, and they cover all BEC, not just supplier fraud. For the wider picture, see our [business email compromise prevention guide](https://iblockspam.com/blog/business-email-compromise-prevention) and our sourced [phishing statistics roundup](https://iblockspam.com/blog/phishing-statistics).

## How does a payment redirection attack work?

1. **Access or impersonation.** The criminal either breaks into a mailbox at the supplier (or at your company) or sets up a lookalike domain.
2. **Watching.** With mailbox access, they read invoices and payment schedules and learn who approves what. They may add inbox rules to hide replies from the real owner.
3. **The switch.** Just before a payment is due, they send new bank details, often on a convincing letterhead or as an edited PDF invoice.
4. **Pressure.** "Our old account is frozen for an audit." "Please pay today to avoid late fees." "I'm traveling, email only."
5. **Cash-out.** Money lands in a mule account and is moved on, sometimes abroad.

If the email comes from the supplier's real, compromised mailbox, it can pass SPF, DKIM and DMARC. That's why the process controls below matter more than any single technical check.

## What are the red flags of a fake bank detail change?

Train everyone who touches payables to stop and verify when they see any of these:

- **Any change to bank details**, however routine it sounds. This alone is enough to trigger a call-back.
- **A new account in a different name**, region or country from the supplier.
- **Urgency or secrecy**: a deadline, a threat of late fees, "don't call, I'm in meetings."
- **A changed reply-to address**, or a sender domain that's slightly off. The IC3 advises you to "verify the email address used to send emails, especially when using a mobile or handheld device" ([IC3 PSA](https://www.ic3.gov/PSA/2024/PSA240911)).
- **Odd timing**: a request just before a large or end-of-month payment.
- **Small changes in tone or formatting** from a contact you know well.
- **An invoice for something nobody ordered.** The FTC tells businesses to "check all invoices closely."

## What call-back procedure stops payment redirection?

The IC3's first prevention tip is to "use secondary channels and/or two-factor authentication to verify requests for changes in account information." The UK NCSC recommends "ensuring that all important email requests are verified using a second type of communication," and that staff are "familiar with the normal ways of working for key tasks" such as how payments are made ([NCSC](https://www.ncsc.gov.uk/guidance/phishing)).

Turn that into a written procedure that applies to everyone, including owners and partners.

### The bank detail change procedure

1. **Freeze the request.** Don't update the vendor record or pay anything to the new account yet.
2. **Find the number yourself.** Use the phone number in your vendor master file, the original contract or the supplier's official website. Never use a number, link or contact from the email or invoice that asked for the change.
3. **Call a person you know.** Ask them to confirm the old account, the new account and why it changed. If you reach someone you don't know, call back through the main switchboard.
4. **Don't accept a call-back from them.** An inbound call "confirming" the change could be the criminal.
5. **Get a second approver.** A different person signs off the change in the vendor record. They check that steps 2 to 4 happened.
6. **Record the check.** Log the date, the number you called, who you spoke to and who approved it.
7. **Test with a cooling-off period.** Where you can, hold the first payment to a changed account for a short period, or confirm receipt of a small first payment with the supplier by phone before sending the rest.
8. **Watch the next payment.** Ask the supplier to confirm receipt. If they say they haven't been paid, start the incident steps below at once.

### Tell your suppliers and customers how you work

Fraud runs both ways: criminals impersonate your suppliers to you, and impersonate you to your customers. The NCSC suggests telling suppliers and customers what to expect, for example that "our bank details will not change at any point." Put a line in your invoice footer and onboarding packs saying you'll never change bank details by email alone, and that customers should call you on a known number before paying a new account.

### Tighten vendor master file controls

The FTC advises making sure "your company's procedures are clear for approving purchases and invoices from vendors you actually work with." In practice:

- Separate duties: the person who changes bank details shouldn't be the one who releases payments.
- Restrict who can edit the vendor master file, and review changes weekly.
- Flag any payment to an account changed in the last 30 days, or whatever window suits you, for extra review.

## Which email controls reduce invoice fraud?

Process stops most attacks. These controls shrink how many reach your team.

### Protect your own domain with DMARC

If your domain has no enforced DMARC policy, criminals can send invoices that appear to come from your exact address. The NCSC notes DMARC "stops phishers from spoofing your domain." Move to `p=quarantine` or `p=reject` in stages using our [DMARC p=none to p=reject guide](https://iblockspam.com/blog/dmarc-none-to-reject-small-business), and check where you stand with the [DMARC Checker](https://iblockspam.com/tools/dmarc-checker). Our [October 2026 scan of the Tranco top 1,000](https://iblockspam.com/research/email-security-top-1000) found 38.3% of domains didn't enforce DMARC. You can draft a policy with the [DMARC Generator](https://iblockspam.com/tools/dmarc-generator).

### Catch lookalike domains

DMARC can't help when the criminal registers `examp1e-supplies.com` instead of `example-supplies.com`. Inbound filtering with impersonation checks, external sender tags and first-contact warnings help here. Our guide to [lookalike domain phishing](https://iblockspam.com/blog/lookalike-domain-phishing) explains the techniques and defenses.

### Secure the mailboxes that handle money

Account takeover is how criminals find invoices to copy. CISA's [phishing guidance](https://www.cisa.gov/sites/default/files/2023-10/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One_508c.pdf) recommends MFA and prioritizes phishing-resistant MFA for privileged accounts. Start with accounts payable, finance and leadership, and review their mailboxes for unexpected forwarding or inbox rules.

### Make reporting easy

CISA encourages organizations to use the reporting features built into Outlook and other cloud email platforms. A quick report from one clerk lets you warn everyone else before the next payment run.

## What should you do if money has already been sent?

Time decides whether money comes back. The FBI's guidance in the 2025 IC3 report is direct: "If you discover a fraudulent transfer, time is of the essence."

1. **Call your bank now.** Ask it to "request a recall of the funds along with any necessary indemnification documents." Ask what help it can give; the IC3 notes that "different financial institutions have varying policies."
2. **File a complaint at [ic3.gov](https://www.ic3.gov).** Do it "regardless of the amount lost," and include the full transaction details. The IC3 says it "may be able to assist both the financial institutions and law enforcement in freezing funds."
3. **Call the real supplier** on a known number. Their mailbox may be compromised, and other customers may be targeted.
4. **Secure your own mailboxes.** Reset passwords, revoke sessions and check inbox rules for anyone involved. Our guide on [what to do after a phishing click](https://iblockspam.com/blog/what-to-do-after-clicking-phishing-link) has the full checklist.
5. **Preserve evidence.** Keep the original emails with full headers, the invoice and payment records. The [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) shows which server really sent the message.
6. **Tell your insurer** if you have cyber or crime cover.

### How the IC3 Recovery Asset Team helps

The IC3 Recovery Asset Team (RAT) was established in 2018 and works with banks through the Financial Fraud Kill Chain (FFKC) to freeze fraudulent transfers. In 2025 it initiated 3,900 FFKC incidents across all fraud types, with $1,163,919,846 in attempted theft and $679,013,183 frozen, a 58% success rate ([2025 IC3 Annual Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)).

The same report describes a city government office in Oregon that lost over $6 million to a BEC wire. The recipient account had already been flagged and frozen through the FFKC after an earlier victim's complaint. So the recipient bank contacted the sending bank to confirm the wire instructions, they were found to be fraudulent, and the originating bank was able to issue a recall. Reporting quickly helps the next victim, too.

## Invoice fraud prevention checklist

| Control | Owner |
|---|---|
| Written bank detail change procedure with call-back on a known number | Finance |
| Second approver for vendor record changes | Finance |
| Separation between changing bank details and releasing payments | Finance |
| "We never change bank details by email" notice to customers and suppliers | Finance |
| DMARC at quarantine or reject on your domain | IT |
| Impersonation and lookalike-domain filtering | IT |
| MFA on every mailbox, phishing-resistant for finance | IT |
| Bank fraud line and ic3.gov in your incident plan | Finance |

## Next steps

1. Write the eight-step bank detail change procedure into your payables process this week, and walk every approver through it.
2. Add a "we never change bank details by email" line to your invoices.
3. Check your domain with the free [Email Health Check](https://iblockspam.com/tools/email-health-check) and fix any gaps in SPF, DKIM or DMARC.
4. Put your bank's fraud number and the ic3.gov link in your incident plan. For domain-level inbound filtering with phishing and spoofing protection in front of your existing mailboxes, see [how iBlockSpam works](https://iblockspam.com/how-it-works).

If attackers register a look-alike of your own domain to fool your customers, iBlockSpam's [Lookalike Domain Watch](https://iblockspam.com/features/lookalike-domain-watch) can alert you when it appears, so you can warn them.

Browse our other [phishing and threat guides](https://iblockspam.com/blog/topic/threats).

## Frequently asked questions

### What is payment redirection fraud?

Payment redirection, also called payment diversion or vendor email compromise, is when a criminal impersonates a supplier you already pay and asks you to send money to a new bank account. The invoice is often genuine or nearly so. Only the bank details change, which is why it is hard to spot.

### How do I verify a supplier's new bank details?

Call the supplier on a phone number you already hold, from your vendor records, a contract or their official website. Never use a number in the email or invoice asking for the change. Ask a contact you know to confirm both the old and new account, then record who confirmed it and when.

### Can I get money back after paying a fake invoice?

Sometimes, if you act fast. Call your bank immediately and ask for a recall, then file a complaint at ic3.gov with full transaction details. In 2025 the IC3 Recovery Asset Team handled 3,900 fraud incidents and helped freeze $679,013,183, a 58% success rate. Delay lowers the chance.

### Is the supplier liable if their email was hacked?

That depends on your contracts, the facts and local law, so ask a lawyer and your insurer. Practically, both sides should report it, preserve the emails and headers, and compare records. Agreeing a written bank-change procedure with key suppliers in advance avoids most of these disputes.

### Does DMARC stop invoice fraud?

At p=quarantine or p=reject, it tells receivers to block or junk unauthenticated email that uses your exact domain, so criminals can't easily invoice your customers as you. It doesn't stop a lookalike domain or a message from a supplier's real, compromised mailbox. Use DMARC alongside a call-back procedure, which works whatever the email looks like.

## Sources

- [FBI IC3: 2025 IC3 Annual Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)
- [FBI IC3 PSA: Business Email Compromise: The $55 Billion Scam (2024)](https://www.ic3.gov/PSA/2024/PSA240911)
- [FTC Consumer Alert: Run a small business? Pay your bills, not scammers (2026)](https://consumer.ftc.gov/consumer-alerts/2026/05/run-small-business-pay-your-bills-not-scammers)
- [NCSC (UK): Phishing attacks, defending your organisation](https://www.ncsc.gov.uk/guidance/phishing)
- [CISA, NSA, FBI, MS-ISAC: Phishing Guidance: Stopping the Attack Cycle at Phase One (October 2023)](https://www.cisa.gov/sites/default/files/2023-10/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One_508c.pdf)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.

---

Source: iBlockSpam, https://iblockspam.com/blog/vendor-invoice-fraud-payment-redirection (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt