Is a wire transfer request from a known supplier always safe?
Not if the bank account details have changed. Invoice fraud and payment diversion scams intercept supplier communications to redirect funds.
Last reviewed: 1 August 2026
Explanation
Invoice fraud — also known as payment diversion fraud or mandate fraud — involves a criminal intercepting or impersonating communications between a business and its supplier, then sending a fake invoice or bank-detail-change notification with the fraudster's account details. Finance teams that process the payment believe they are paying a genuine supplier. The fraud is often discovered only when the real supplier chases overdue payment. Before transferring any significant funds to a new or changed bank account, verify the change by calling the supplier on a previously verified phone number — not one included in the email requesting the change.
These attacks are researched, not sprayed. Criminals often compromise a mailbox on one side of the relationship weeks in advance, reading genuine correspondence to learn invoice cycles, project names, and the tone individuals use — then time the fake bank-change request for exactly when a real payment is due. The email that diverts the money can be a reply within an authentic thread, which is why 'it came from the address we always use' is not the reassurance it feels like: the address may be real and the mailbox occupied.
Because detection is so hard at the message level, protection has to live in process. A callback rule for every bank-detail change, using a number from your master vendor records; dual authorisation for first payments to any new account; and a norm that urgency never bypasses procedure — these controls cost minutes and defeat the attack regardless of how convincing the email is. The scam only works where a single person, reading a single message, can redirect funds on their own authority.
Common red flags
- Email from a supplier requesting a change of bank account details
- Invoice bank details differ from those on previous invoices
- Urgent request to process payment immediately
- Email address is slightly different from the normal supplier address
- Supplier or client cannot be reached through previously used contact details
What to do now
- Call the supplier on a verified number to confirm any bank detail changes before paying
- Introduce a two-person authorisation requirement for first payments to new accounts
- Report confirmed fraud to your bank immediately and to Report Fraud (UK, formerly Action Fraud) or the FBI IC3 (US)
- Review email security to check for unauthorised forwarding rules that could allow interception
Frequently asked questions
Can I get a wire transfer refunded after invoice fraud?
Speed is critical. Contact your bank within hours of discovery — they can attempt to recall the payment. Recovery rates are low but highest when action is taken immediately.
The email came from the supplier's real address — how is that possible?
Either the supplier's mailbox is compromised and the criminal is replying inside genuine threads, or the display name is forged over a lookalike address. Both are common, which is why bank-detail changes must be verified by phone on a known number, never by replying to the email.
Sources
- SEC Investor.gov — Protect Your Money: How to Avoid Investment Scams — U.S. Securities and Exchange Commission
- FCA — ScamSmart — UK Financial Conduct Authority
- CFPB — Fraud and Scams — Consumer Financial Protection Bureau
- Scamwatch — Investment Scams — Australian Competition & Consumer Commission