The Invoice Was Genuine. The Bank Account Wasn’t.

Invoice fraud and changed-banking-details scam

Invoice fraud and changed-banking-details scams redirect legitimate payments into criminal accounts. You may lose the money and still owe the genuine supplier.

The work was completed. The goods arrived. The invoice contained the correct amount, reference number and familiar company logo. Then an email explained that the supplier’s banking details had changed. You updated the beneficiary, authorised payment and sent the proof.

Days later, the supplier asked when you would pay.

This is the danger of payment-redirection fraud: the transaction can be genuine while the instructions are false. Criminals do not always need to invent a business or steal your banking password. Sometimes they persuade you to make the transfer yourself.

What Is Business Email Compromise?

The FBI describes business email compromise, or BEC, as fraud involving messages that appear to come from a known source and request an apparently legitimate action. Examples include supplier payments, instructions from executives and property-transfer payments. Both businesses and individuals can be targeted. FBI explanation of business email compromise.

In invoice fraud, criminals may create a false invoice, alter a genuine one or send replacement payment instructions. The crucial question is not simply whether you owe the money. It is whether the account receiving it has genuinely been authorised by the person or business you owe.

How Criminals Enter a Genuine Transaction

There are several routes. Criminals can use a lookalike email address, impersonate a familiar sender or gain access to a real mailbox through phishing or malicious software. Access to correspondence can reveal invoice amounts, deadlines and the people responsible for payment, making a fraudulent instruction unusually convincing. FBI guidance on how BEC operates.

A message may therefore arrive at exactly the moment you expect to pay. The wording can fit the conversation because the criminal has seen it.

The important distinction is between an authentic-looking message and an independently verified instruction. Checking spelling and the sender’s address is useful, but it cannot establish who is controlling a genuinely compromised account.

The Supplier’s Banking Details Have “Changed”

The explanation may sound routine: the company has moved banks, closed an account or updated its payment arrangements. Standard Bank warns that criminals impersonate trusted suppliers and request changes that send subsequent payments to fraudulent accounts. Its guidance also covers fake invoices resembling those issued by genuine suppliers. Standard Bank’s business-scam guidance.

Consider this fictional example: a business owes its supplier R85,000. Shortly before payment, an email supplies a replacement invoice. The amount and goods are correct; the bank account is different. The accounts team treats the document as confirmation and pays.

A comparison with the previous invoice might identify the change. But identifying a change is only the beginning. It must then be verified through a channel the suspicious message does not control.

The Invoice May Be Real, but the Debt May Still Be Unpaid

Being scammed does not automatically extinguish your obligation to pay the genuine invoice. Money leaving your account is not necessarily money reaching the creditor or an authorised recipient.

South African courts have addressed this directly. In Intengo Imoto v Zoutpansberg Motor Wholesalers, decided by the Supreme Court of Appeal on 20 June 2025, payment for vehicles was diverted to an unauthorised account. The purchaser failed to establish that it had discharged its payment obligation, and the court upheld the seller’s appeal. The case demonstrates that a fraud victim can remain liable for the original purchase price. Supreme Court of Appeal judgment.

This does not mean every victim, in every country, must automatically pay twice. Liability depends on the evidence, contract, authority, conduct of the parties and applicable law. Insurance or another claim may also require investigation. Obtain qualified legal advice before assuming either that the debt has disappeared or that another party must absorb the loss.

Proof that you made a transfer may not prove that you paid the person you owed.

Fake Employer Instructions Exploit Authority

A supposed director or manager requests an urgent transfer and tells the employee not to follow the usual process. The request may invoke confidentiality, an approaching deadline or an important commercial opportunity.

Australian government guidance identifies employee impersonation, false invoices and pressure to bypass procedures as BEC risks. A message from someone senior should not exempt a payment from verification. Australian guidance on payment and banking-detail requests.

Managers should explicitly support staff who pause unusual instructions. A control is ineffective if employees believe they will be punished for using it when the supposed requester is their boss.

Payroll Can Be Redirected Too

The target is not always a supplier payment. Criminals can impersonate an employee and ask payroll to change salary banking details. They may also compromise an employee’s payroll account and alter the destination directly. IC3 has documented both approaches. IC3 warning covering payroll diversion.

Employers should verify changes through an established identity-checking process, not merely accept a signed form or an email from the employee’s address. Employees should use their employer’s known payroll channels and query missing salary deposits promptly.

A last-minute request before payroll closes deserves verification, not an exception.

Property Payments and Refunds Are Particularly Sensitive

A property transaction involves large sums, deadlines and several professionals. Criminals can impersonate conveyancers, buyers or sellers to redirect deposits, purchase money, sale proceeds or refunds.

South Africa’s Legal Practitioners Indemnity Insurance Fund describes a scheme in which a conveyancer redirected a deposit refund after receiving false instructions. Meanwhile, the genuine purchaser received messages explaining the supposed delay. Lookalike addresses helped mislead both sides. The fund also warns that written instructions, stamped bank statements and bank letters can be forged. LPIIF conveyancing-scam warning.

Agree on a secure verification process at the beginning of the transaction. Confirm the authorised receiving account and the procedure for any change. A lawyer’s trust account may legitimately receive money on someone’s behalf, but that authority and those banking details still need independent confirmation.

Why Asking by Email Is Not Enough

Replying, “Please confirm these banking details,” may simply invite the criminal to confirm their own instructions. Calling the number on the replacement invoice can create the same problem.

Standard Bank advises using a number already held on file rather than one supplied in the suspicious email. It also recommends inspecting the full address and slowing down urgent requests. Standard Bank’s changed-banking-details guidance.

Ask the established contact to confirm the account details, the reason for the change and who authorised it. If you cannot verify the instruction, pause payment and escalate through your normal process.

Do not rely on recognising a voice alone. Australian guidance now addresses synthetic voice and video impersonation, recommending pre-established authentication or independent trusted channels for sensitive requests. Australian guidance on synthetic impersonation.

Bank Verification Helps, but It Answers a Limited Question

Where available, use your bank’s account-verification service and investigate mismatches, warnings or unavailable results. Standard Bank recommends account-verification tools alongside direct supplier confirmation. Standard Bank payment-verification guidance.

Understand what the particular service checks. Do not confuse a beneficiary label you typed yourself with a bank-confirmed account-holder identity. Even an ownership check does not, by itself, establish the account holder’s authority to receive this particular payment.

Likewise, a small test transfer only shows that money reached an account unless you independently confirm receipt with the genuine intended recipient. Confirmation through the same questionable email conversation is not an independent check.

A Practical Process for Businesses

Make payment verification a repeatable procedure rather than a judgment based on whether an email feels convincing.

• Verify new supplier banking details before the first payment, not only when an account changes.
• Require independent confirmation before changing supplier or employee payment records.
• Record who verified the instruction, the trusted channel used and the details confirmed.
• Separate account-detail maintenance from payment approval where staffing permits.
• Give the approver access to the verification record, not just the invoice.
• Escalate unusual amounts, secrecy demands and requests to bypass controls.

Two people approving the same unverified document is not the same as two independent checks. In a small business, a second person can review the verification record even if there is no separate accounts department.

Australian cyber guidance recommends consistent processes for payment and account-change requests, staff training and protection of email accounts. Guidance on protecting against BEC.

Protect the Email Accounts Behind the Payments

Use strong, unique passwords and multi-factor authentication for email and financial systems. Ask your IT provider about phishing-resistant authentication, email-authentication controls and monitoring for suspicious access. These reduce risk but do not replace payment verification. Australian BEC prevention guidance.

If a mailbox has been compromised, changing its password may not complete the response. Microsoft’s guidance includes revoking active sessions, reviewing authentication methods and removing suspicious forwarding settings and inbox rules. An IT professional should also investigate how access occurred and what information was exposed. Microsoft guidance for compromised email accounts.

Customers may continue to trust messages from your business name. Warn affected contacts through verified channels rather than relying only on the mailbox under investigation.

What to Do Immediately After a Fraudulent Payment

Contact your bank’s fraud team immediately using independently verified contact details. Explain that the payment was redirected through false instructions. Ask whether the transfer can be stopped or recalled and whether the receiving bank can be contacted urgently. Provide the account, amount, reference and payment time. The FBI and IC3 both emphasise rapid contact with the originating financial institution. Recovery is not guaranteed. FBI response guidance, IC3 BEC incident guidance.

Notify the genuine supplier, employer or conveyancer independently. Preserve original emails, headers, attachments, invoices, payment records and verification notes. Involve IT or a reputable incident-response provider, and report the fraud to the appropriate police or cybercrime service.

Discuss the unpaid obligation with the genuine creditor and seek legal advice where liability is disputed. Do not ignore a legitimate demand because a transfer has already left your account.

The Incident May Involve Personal Information Too

A compromised mailbox can expose customer records, employee information and transaction documents. For South African organisations, consider whether the incident triggers obligations under POPIA. The Information Regulator explains notification requirements for security compromises affecting personal information. Get appropriate advice rather than treating every payment scam as automatically the same kind of data breach. Information Regulator guidance.

Check any relevant insurance notification requirements promptly. Do not assume ordinary business or professional insurance automatically covers payment-redirection losses.

Before You Pay, Verify the Destination

For further steps after a loss, read our guide to what to do immediately after being scammed. Our old scams, new technology guide explains why familiar-looking communications no longer establish identity.

A supplier can genuinely be owed money. An employer can genuinely need a payment made. A property transaction can genuinely be approaching completion. None of those facts authenticates a newly supplied bank account.

The invoice may be genuine. The account may not be. And paying the wrong account may leave you with both a financial loss and an unpaid debt.