How to Stop Invoice and Bank Detail Fraud: A 5-Step Call-Back Process
Invoice fraud prevention depends on verifying changes to payment instructions outside the email conversation. Use a five-step call-back process: pause the payment, find a trusted telephone number, speak to an authorised contact, independently confirm the bank details and record approval. Never use a phone number supplied only in the suspicious message.
Key takeaways
- Invoice fraud occurs when a criminal persuades an organisation to send money to the wrong account, often by impersonating a supplier or intercepting an email conversation.
- Pause whenever a supplier changes bank details, asks for unusual urgency or requests an exception to normal approval.
- Use a number already held in your verified supplier record or independently established through a trusted channel.
- Speak to a known, authorised supplier contact.
What is invoice fraud and how does it happen?
Invoice fraud occurs when a criminal persuades an organisation to send money to the wrong account, often by impersonating a supplier or intercepting an email conversation. A genuine-looking invoice is not proof that bank details are genuine. Attackers may use a compromised mailbox or a lookalike domain.
Step 1: When should your team pause a payment?
Pause whenever a supplier changes bank details, asks for unusual urgency or requests an exception to normal approval. Do not assume that a familiar sender name means the email is safe. Record the request and tell the requester that your verification policy applies to everyone.
Step 2: Which number should you call?
Use a number already held in your verified supplier record or independently established through a trusted channel. Do not rely on a telephone number in the bank-change email, its attachment or a link in the message. This prevents an attacker from controlling both sides of the supposed verification.
Step 3: Who should confirm the change?
Speak to a known, authorised supplier contact. Ask them to confirm the change using the supplier’s agreed verification process. For high-value payments, use a second internal approver. If the supplier contact cannot verify the change, stop and escalate.
Step 4: What details must be checked?
Confirm the account name, sort code, account number, reason for the change and effective date. Where available, use Confirmation of Payee as an additional check, not a substitute for a trusted call-back. Keep the previous account on hold until the new instructions are approved.
Free download: get the Payment & Bank Change checklist to turn this advice into a repeatable process.
Step 5: How should approval be recorded?
Record who called, the trusted number used, the person reached, the details confirmed, the approver and the date. Keep the record with the supplier master file. Separate the person changing bank details from the person releasing the payment wherever staffing allows.
What if the payment has already gone?
Contact your bank immediately using a trusted number and explain that the payment may be fraudulent. Alert your IT or security contact, preserve the emails and report the incident through the appropriate UK fraud-reporting channel. Fast action may improve recovery prospects, but repayment is not guaranteed.
Can email authentication stop invoice fraud on its own?
SPF, DKIM and DMARC help protect against some forms of domain spoofing. They do not prevent every compromised mailbox or convincing impersonation. Combine email controls, staff awareness and the five-step call-back rule.
What should you do next?
If you are unsure where your current setup stands, Be Tech Secure can help you identify priorities and explain practical next steps. Request a free security risk review or book a short discussion.
Frequently asked questions
What is the first step for a small business?
Start with a clear inventory of users, devices, accounts and essential systems. Then confirm the controls most likely to reduce immediate risk. Assign one person to track the actions and dates. A small, verified improvement is more valuable than a long checklist nobody owns.
Can we do this without an in-house IT team?
Yes. A small business can assign internal ownership while using an external provider for technical changes and monitoring. The key is to agree who approves access, who receives alerts and who responds to incidents. Do not assume those responsibilities are included in a support contract.
How often should we review our arrangements?
Review important accounts and alerts routinely, and schedule a wider review at least every six months. Reassess sooner after a significant staffing, supplier, licence or system change. Record what was checked, what was fixed and which risks remain open.
Will one product solve the problem?
No single product covers people, processes, devices, email, identity and recovery. Choose a combination of controls that fits your actual risks. Ask vendors to explain what they do not cover, how incidents are handled and which tasks remain your responsibility.
