Fake invoices and supplier impersonation are among the most common, and costly, types of fraud established businesses face.
Verifying a change of payment details before you act on it, rather than acting on the email alone, is one of the simplest controls available to stop it.
Why invoice fraud is different
- Established businesses often work with dozens of suppliers, and any one of them changing their bank details is a normal, routine event, which is exactly what fraudsters rely on to go unnoticed.
- Fraudsters don't need to breach your systems. One convincing email, with just the bank details changed, is enough.
- Increasingly, that email comes from a genuinely compromised mailbox, a supplier's, an accountant's, or a colleague's, not a spoofed one made to look similar.
- Once a payment has gone to the wrong account, it is very rarely recoverable.
What verifying a supplier actually means
Verification means confirming a change to payment details independently of the message that raised it, before any payment goes out. In practice that means:
- Calling the supplier on a number you already hold on file, never one taken from the email or invoice itself.
- Agreeing a named contact for anything to do with payment or bank detail changes, so you're not verifying with whoever happens to reply.
- Treating an unexpected or urgent request to update bank details as a reason to check, not a reason to act quickly.
Why this control works
Fraud like this succeeds because the message often looks completely genuine. If a supplier's or accountant's mailbox has been compromised, the fraudster is sending from a real, familiar address, sometimes in the middle of a thread you've been having for months.
Replying to double-check doesn't help in that scenario, since the reply goes straight back to whomever controls that mailbox.
A phone call, started independently by you, breaks that chain and defangs the fraud attempt.
Examples of how this looks in practice
- A compromised accountant mailbox: a business receives an email from their accountant's genuine email address, part of an existing, ongoing conversation about an upcoming payment. The email asks for funds to be sent to a new account, explaining the old one is being switched. Nothing about the email looks unusual, because the accountant's mailbox has been hacked and the fraudster is sending from the real account. The business pays, and only discovers the problem when the accountant later asks why the invoice hasn't been settled.
- A sudden change in supplier details: a regular supplier's invoice arrives as usual, but with a note that their bank has changed and payment needs to go to a new account, perhaps "for this invoice only." The email address looks right, the invoice looks right, and the amount is one the business was already expecting to pay. The only thing that's changed is where the money is going.
Won't this slow down paying my suppliers?
Only the moment it needs to. A quick call to confirm a change of bank details takes minutes, and it's only needed when details change, not for every invoice you already recognise.
Set this process up once and it becomes a simple part of your routine, rather than a delay.
Ideas to consider
Every business is different, and no single step removes the risk of payment fraud. Some things businesses find helpful:
- Having a named contact for supplier payment queries, so everyone knows who to check with.
- Keeping a record of bank details once they’ve been verified, so new invoices can be compared against what you already hold.
- Using second approvals on payments, if that suits how your business works. Here's how to set up payment approvals in your Allica account.
- Reviewing your supplier list from time to time, not only when a change request comes in.
Summary
Verifying a supplier takes a few minutes and costs nothing. It works so effectively because it takes the fraud attempt out of its convincing context..
If you'd like help putting this into your process, your relationship manager can talk you through it.
Worried about fraud?
Visit our Fraud Centre for immediate help and further advice.
