Category hub: Social engineering and human risk

In one sentence: Invoice fraud is when criminals send a fake invoice, or change the bank details on a real one, so that your payment goes into their account instead of your supplier’s.

What it is

Invoice fraud tricks a business into paying the wrong place. In one form the invoice is fake. In the other, a genuine supplier’s bank details are changed.

The NCSC describes a criminal sending an invoice that looks real, or asking you to pay into a different bank account, and calls it business payment fraud, also known as business email compromise. Barclays says it is also called mandate fraud and is usually only found when the real supplier later asks for payment.

How it works

1. The criminal learns your supplier relationships, from a hacked mailbox, public contract information or a spoofed address.
2. They send an email that looks like it is from the supplier.
3. It says bank details have changed, or sends an invoice with new details, and often stresses urgency.
4. Your accounts team updates the supplier record and pays.
5. The money is moved on quickly. The fraud usually shows only when the real supplier chases.

No malware is needed. The attack works because email alone is trusted as proof.

Who it affects and how badly

• Sole trader to 10 staff. One person pays the bills, so one changed bank detail can wipe out a month’s cash.
• 10 to 250 staff. Construction and trades firms, accountancy practices, recruiters, estate agents, schools and charities handle many invoices and changes. A paid fake is hard to get back.
• 250 plus and regulated firms. Large supplier lists hide changes. Councils, fintech, insurers and healthcare providers may have to report the loss and review controls.

Action Fraud figures reported by Infosecurity Magazine put 83 invoice fraud victims in September 2025 at an average of about £47,000 each.

Real examples

• Google and Facebook, 2013 to 2015. The US Department of Justice says a Lithuanian man registered a company with the same name as a real Asian hardware manufacturer. Phishing emails and forged invoices, contracts and letters led two US internet companies to wire more than $120 million to accounts he controlled. He was sentenced to five years in prison. The indictment does not name the victims.
• NCA and NatWest campaign. It urges “Check, Verify, Never”: check for changes, verify them with trusted contacts, never pay until satisfied.

How to detect it

• A bank detail change, or a new supplier, that arrives by email only.
• An invoice that does not match a purchase order or an agreed amount.
• A sender address that is almost right, or a reply-to on a different domain.
• Pressure to pay quickly or keep the change quiet.
• Hidden inbox rules or forwarding in finance mailboxes in Microsoft 365 or Google Workspace.

How to fix or prevent it

1. Check every bank detail change by phoning the supplier on a number you already hold. Barclays and the NCA both advise this.
2. Never use contact details from the email that asked for the change.
3. Require a second person to approve new suppliers and changes.
4. Match each invoice to a purchase order or contract before paying.
5. Treat a Confirmation of Payee name mismatch as a stop sign.
6. Protect finance mailboxes with MFA and monitor for forwarding rules.
7. Train accounts staff with realistic simulations.
8. If you have paid in error, call your bank at once, then report to Report Fraud.

Related terms

• Business email compromise
• CEO fraud
• Payment diversion fraud
• Phishing
• Spear phishing
• Multi-factor authentication

FAQ

What is the difference between invoice fraud and mandate fraud?
They describe the same scam. Barclays says invoice fraud is also known as mandate fraud.

How should I check a changed bank account?
Phone the supplier on a number you already hold, not one from the email.

Does invoice fraud need malware?
No. The NCSC describes it as a fake or changed invoice that asks you to pay a different account.

Sources

• https://www.ncsc.gov.uk/section/respond-recover/business-payment-fraud
• https://www.infosecurity-magazine.com/news/nca-natwest-warning-over-invoice/
• https://www.justice.gov/usao-sdny/pr/lithuanian-man-sentenced-5-years-prison-theft-over-120-million-fraudulent-business
• https://www.barclayscorporate.com/insights/fraud-protection/invoice-fraud/

How Wolfcore helps

Phishy runs realistic phishing simulations against your own staff and shows you who clicked, so you can train the people attackers target. See Phishy phishing simulation.