Invoice and bank-transfer fraud: verify every new beneficiary

How legitimate business processes are hijacked

An attacker may wait until a real supplier invoice is due, then introduce altered payment details. The goods, contract and conversation can be legitimate while the destination account is not.

A look-alike email domain or compromised mailbox can make the instruction seem authentic. Staff should not rely solely on being inside an existing email thread.

Why email history is not sufficient proof

Require a callback to a verified contact already in your records before approving a new bank account. Document who confirmed the information and when.

Accounting controls may detect unusual changes, but they must be supported by operational rules that hold when an urgent payment is demanded.

Practical checks

• Confirm payee changes independently
• Separate setup and approval functions
• Keep an auditable confirmation record
• Act promptly if a transfer was misdirected

What to do after a suspicious transfer

If money may have been misdirected, contact the bank immediately via official channels and retain the transaction reference.

Vigifraude approaches payment fraud as an information-authentication problem, drawing on Alain Stevens’s digital risk experience since 1999.

Related resources

Build a suitable control

The most expensive exception is often the one that bypassed a well-known rule.

For a technical question, software project or training request, describe the need without sending credentials or unnecessary personal data.