A fake invoice email is one of the most expensive scams a small business can fall for, and one of the easiest to miss. There’s no virus and nothing obviously wrong with your computer. Just an email that looks like it came from a supplier you deal with every month, asking you to pay an invoice or telling you their bank details have changed.
Pay it, and the money goes to a criminal’s account. Banks can sometimes recover it if you act very quickly, but often it’s gone.
This kind of fraud is sometimes called invoice fraud, mandate fraud or business email compromise. Whatever the name, the good news is that a few simple habits stop almost all of it.
How the scam works
There are three common versions, and the last two are the dangerous ones because the email genuinely looks right.
- A lookalike address. The email comes from something that looks like your supplier’s address at a glance, such as an extra letter, a missing letter, or a different ending like .co instead of .co.uk.
- Your supplier’s mailbox has been hacked. The email really does come from their address, often as a reply in a genuine conversation you’ve been having with them. The criminal has been reading their email and waiting for an invoice to be due.
- Your own mailbox has been hacked. The criminal sends fake invoices to your customers from your address, or quietly changes the bank details on invoices you send out.
Warning signs to look for
None of these prove an email is fake on their own, but any one of them is a reason to stop and check.
- A change of bank details. This is the big one. Genuine suppliers do change banks, but rarely, and it should always be checked.
- Urgency or secrecy. “Please pay today”, “our account is being audited”, “don’t use the old details”, or a request not to phone because the person is in meetings.
- A slightly different email address. Look at the full address, not just the name shown. On a phone, tap the sender’s name to see it.
- Replies going somewhere else. When you click Reply, check the address it’s going to. Criminals often set a different reply-to address.
- A link to “view the invoice” that asks you to sign in. This is usually an attempt to steal your email password, which can lead to the third version of the scam above.
- Something feels off. A different tone, unusual spelling, a new contact name, or a request timed for late on a Friday when nobody can check.
The one rule that stops most of it
Never change bank details, or pay to new bank details, without phoning the supplier on a number you already have.
Not a number from the email, the invoice or the email signature, because the criminal can change all of those. Use the number from your own records, a previous invoice you know is genuine, or their website.
It takes two minutes and it is the single most effective protection there is. A genuine supplier will never mind you checking.
Simple checks for whoever pays the bills
- Write the phone-back rule down and make sure everyone who can make payments follows it, including the boss.
- For larger payments, have a second person approve before the money goes.
- Pay attention to your bank’s Confirmation of Payee check. If the bank says the account name doesn’t match, stop and phone the supplier before going any further.
- Keep a list of your regular suppliers’ phone numbers and bank details somewhere that isn’t your email.
Technical protections that make a real difference
Most of these attacks start with a stolen email password, so protecting email accounts protects your money too.
- Multi-factor sign-in on every email account. Even if a password is stolen, the criminal can’t get in without the second step. If you use Microsoft 365, this should be switched on for everyone.
- SPF, DKIM and DMARC on your domain. These make it much harder for criminals to send email pretending to be from your address.
- Good email filtering to catch lookalike addresses and phishing links before they reach anyone’s inbox.
- An “external email” warning at the top of messages from outside your business, so a message pretending to be from a colleague stands out.
- Checking for hidden mailbox rules. After breaking into an account, criminals often set up rules that forward or hide emails so the real owner doesn’t notice. These can be checked for and alerted on.
These are all part of the cyber security work we do for small businesses, and most of them cost little or nothing to set up properly.
What to do if you think you’ve paid a fake invoice
Speed matters. The sooner the bank knows, the better the chance of stopping or recovering the payment.
- Phone your bank straight away using the number on their website or the back of your card, and ask for the fraud team.
- Report it to Action Fraud, the national fraud reporting centre that covers Northern Ireland.
- Change the password on any email account that may have been involved, turn on multi-factor sign-in, and check for mailbox rules you didn’t create.
- Tell the real supplier, by phone. Their mailbox may have been hacked, and other customers could be targeted next.
Suspicious emails that you haven’t acted on can be forwarded to the National Cyber Security Centre at report@phishing.gov.uk, which helps get scam sites taken down.
If it’s your email that’s been hacked
If customers tell you they’ve received odd invoices from you, take it seriously. Change your password, turn on multi-factor sign-in, check for forwarding rules and unfamiliar sign-ins, and let your customers know, by phone if possible, not to pay any bank details they haven’t confirmed with you directly.
Want a second pair of eyes?
If you’re not sure whether your email accounts are properly protected, Business Park Solutions can check them for you. We look at sign-in security, email filtering, SPF, DKIM and DMARC, and mailbox rules, then tell you in plain English what needs fixing. It’s part of the managed IT support we provide to small businesses across Northern Ireland.
Get in touch for a free security review, or call 028 9590 7195.
