Invoice and mandate fraud

Invoice fraud and mandate fraud, together often called payment diversion fraud, are among the most damaging frauds against organisations of every size. The idea is simple: get the victim to send a genuine payment to the wrong bank account.

How it works

A fraudster contacts your organisation posing as a supplier you already pay. The message, usually an email, says the supplier has changed banks and asks you to update the account details on file. The next genuine invoice is then paid to the fraudster's account. By the time the real supplier chases the missing payment, the money has been moved on.

The most convincing versions start with a compromised email account. If the fraudster has access to the real supplier's mailbox, the request comes from the genuine address, mid-thread, referencing real invoice numbers and real people. Nothing about the email itself looks wrong, because the email itself is real. Only the bank details are false.

A related version targets the payment itself rather than the stored details: a plausible-looking invoice arrives for goods or services that were never ordered, hoping to slip through a busy accounts payable process.

Warning signs

• Any request to change bank account details, however routine it looks
• New pressure or urgency around a payment that was previously routine
• Subtle changes in an email address, such as one letter altered or a different domain
• Changes to payment details announced only by email, with reasons why phone contact is difficult
• Invoices from unfamiliar suppliers, or amounts and references that don't match a purchase order

The core defence

Treat bank account details as the most sensitive data a supplier gives you. Any request to change them must be verified with the supplier by phone, using a number you already hold from previous dealings, never a number given in the request itself. Section 4 covers this control in detail. For now, remember the rule: the email asking for the change is never, on its own, evidence that the change is genuine.