“We've changed our bank account”: spotting invoice fraud by email and what to do if you have already paid
It is one of the most common frauds between businesses: a customer receives an email that seems to come from the supplier, with a genuine invoice but different bank details, and pays. By the time anyone notices, weeks have passed and each side blames the other.
How fraudsters operate
- They register a domain almost identical to the supplier's (one letter changed or a different extension).
- They send emails from their own server while making the supplier appear as the sender.
- They change the Reply-To field so that replies reach them.
- They keep the conversation going for weeks and chase several invoices.
Where did the spoofing happen?
This is the key question for allocating liability, and it can usually be answered with technical evidence:
- The full email headers show which servers the message passed through and the IP address it was sent from.
- The registration date of the fake domain usually matches the start of the fraud.
- If the customer first received the genuine email and then the fake one, the interception is usually at the recipient's end, not the sender's.
- SPF, DKIM and DMARC only protect if the receiving server checks them.
What to do
- Always verify any change of bank details by phone, using a number you already had.
- If you have already paid, alert your bank immediately and report it to the police.
- Delete nothing: keep the original emails (not forwarded) with full headers.
- Commission an expert report before arguing with the other party: technical evidence usually shows whose side the breach was on.