The effective version of this fraud uses real information, frequently obtained from a compromised mailbox, and asks only that you update payment details. The defence is a verification habit rather than suspicion of anything that looks odd.
Why this one works
Most fraud attempts are obvious. This one is not, because the details are correct.
The invoice references a supplier you actually use, a job you are actually doing, and an amount that matches what you expected. The only thing that changed is where the money goes.
Frequently that is because somebody has access to a mailbox, either yours or your supplier's, and has been reading the correspondence. They know the relationship, the timing, and the language.
Which means the usual advice about spotting suspicious messages does not apply. There is nothing suspicious to spot.
The common shapes
Changed banking details
A message from a supplier saying their bank has changed and asking that future payments go to a new account. Frequently apologetic and routine in tone.
This is the most costly version, because it redirects everything rather than a single payment.
The intercepted invoice
A genuine invoice, altered, forwarded from a compromised mailbox. The supplier believes they sent it and you believe you received it.
The urgent request from the owner
A message appearing to come from you, to whoever handles payments, asking for a transfer to be made quickly and quietly. Frequently timed for when you are known to be away.
The subscription renewal
An invoice for a domain, a listing, or a directory that resembles something you pay for. Small enough to be approved without thought.
The customer overpayment
A customer pays too much and asks for the difference refunded. The original payment is later reversed and the refund is gone.
The one habit that stops most of it
Never change payment details based on a message.
Any request to update banking information gets verified by calling the supplier on a number you already have, from your own records, not one contained in the message.
That single rule defeats the most expensive versions, and it costs a two-minute phone call on an event that happens rarely.
Telling suppliers you do this is worth doing, since it makes the call expected rather than awkward, and a legitimate supplier will not object.
The second habit
A verification threshold for payments.
Above a stated amount, a payment requires confirmation by a second method: a call, or a second person. Below it, normal process.
Setting that threshold at a level your business can absorb losing is the practical way to size it. The urgent-request fraud specifically relies on somebody acting alone under time pressure, and a rule that removes both defeats it.
What to check on an invoice
- Whether the banking details match what you have paid before.
- The sending address in full, since a lookalike domain differs by one character.
- Whether you ordered it, which catches the invented subscription.
- Whether the amount matches the quote.
- Whether the reply address differs from the sending address.
- Whether it arrived at an unusual time relative to how that supplier normally invoices.
The lookalike domain is worth examining carefully. Substituted characters, an added word, or a different extension are all common and all easy to miss at a glance.
Protecting your own mailbox
Because your customers can be defrauded through you.
A compromised business mailbox lets somebody send invoices to your customers, with your details, referencing real jobs. The customer pays, the money is gone, and the dispute is between you and them.
Two-factor authentication on business email is the single most effective protection available, and it is free. Checking for forwarding rules you did not create is worth doing occasionally, since a common tactic is quietly copying correspondence rather than obviously taking over the account.
If it happens
- Contact your bank immediately, since recovery depends almost entirely on speed.
- Contact the receiving bank if you can identify it.
- Report it to police and to the national anti-fraud reporting service.
- Tell the supplier, since their mailbox may be the compromised one.
- Change passwords on email and anything sharing them.
- Check for forwarding rules and unfamiliar sessions.
- Tell your insurer, if you hold cover that may apply.
Recovery is possible in the first hours and increasingly unlikely afterwards, which makes the first step genuinely urgent rather than a formality.
What not to do
Do not assume it will not happen because the business is small. Small businesses are targeted precisely because the controls are lighter and the same fraud costs less effort.
And do not treat somebody who was deceived as careless. These are convincing, they succeed against people who are paying attention, and a culture where somebody hesitates to report a mistake makes the loss worse, which is the same account-hygiene reasoning set out in securing the accounts somebody else could take.
Frequently asked questions
Why is this fraud so effective?
Because the details are correct. It references a real supplier, a real job, and the expected amount, frequently because somebody has been reading a compromised mailbox.
What is the most costly version?
A message saying a supplier's bank has changed, since it redirects every future payment rather than a single one.
What single habit stops most of it?
Never change payment details based on a message. Verify by calling the supplier on a number from your own records, not one contained in the message.
What should a payment threshold do?
Above a stated amount, require confirmation by a second method or a second person. The urgent-request fraud relies on somebody acting alone under time pressure.
How can my customers be defrauded through me?
A compromised business mailbox lets somebody invoice your customers using your details and real jobs. Two-factor authentication on email is the most effective protection available.
What matters most if it happens?
Speed. Contact your bank immediately, since recovery is possible in the first hours and increasingly unlikely afterwards.
West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.
Received a message saying a supplier changed banks?
We set the verification habit and check your mailbox for the forwarding rules that usually come first.
Start a Conversation