Invoice fraud is stopped by treating a change of bank details as a security event rather than an administrative update. The invoice itself is usually genuine in form, correct in amount, and wrong only in where the money goes.
This is what makes it hard to catch. Nothing in the document looks suspicious, because the attacker has often read real correspondence first and knows what a normal invoice from that supplier looks like.
Documented cases
- Evaldas Rimasauskas registered a company sharing a name with a real hardware maker and invoiced Google and Facebook for $120 million.
- Cabarrus County was induced to redirect payments after attackers posed as a construction vendor.
- Philadelphia School District shows the same pattern against a public body in 2024.
The control that breaks it
- Lock the vendor master file. Bank-detail changes require callback plus a second approver.
- Compare every invoice against the purchase order and the contracted rate, not just against the last invoice.
- Flag first-time payees and any account in a country the supplier does not operate from.
- Give accounts-payable staff a no-blame route to hold a payment.
Related: invoice fraud vs BEC · how to verify a wire transfer · Invoice fraud
Related
Social Engineering Examples