The email that costs an organisation money is rarely the obvious one. It is not badly spelled, it does not come from a stranger, and it does not ask for anything unusual. It asks you to pay an invoice you were already expecting, into an account that has changed.
Government figures put this kind of attack at the top of the list. In the Cyber Security Breaches Survey for 2025/2026, phishing was the most common type reported by UK businesses, well ahead of anything else.
Why it works
Three things make a fraudulent invoice convincing.
It is expected. Either the sender has seen real correspondence, because a supplier’s mailbox was accessed, or they have guessed correctly that an invoice is due. An email that matches what you were waiting for gets far less scrutiny.
It comes from the right place. Often from the supplier’s genuine address, because the fraud starts in their mailbox rather than yours. Checking the sender then proves nothing.
It is polite and unhurried. The crude version demands payment today. The effective version mentions in passing that the bank details have changed, and asks you to update your records.
The checks that actually catch it
- Any change of bank details is treated as suspicious. Not rude, not unusual, just suspicious. This is the single most useful habit, because a change of account is the only part the fraudster genuinely needs.
- Verify by voice, on a number you already hold. Not a number in the email. Not by replying. A number from a previous invoice, your own records, or the supplier’s website.
- Check whether the reply address matches the sender address. A reply to header pointing somewhere else is a strong signal, and it is invisible until you look.
- Look at the thread, not the message. Fraudulent replies often appear inside a real conversation but with the earlier messages subtly rewritten. Compare against your own sent items rather than the quoted text.
- Be wary of a first invoice from a supplier you have not paid before. There is no existing record to contradict, which is exactly why it is attractive.
The rule worth writing down
No change to payment details is ever actioned on the strength of an email. It is confirmed by voice on a previously known number, by a named person, and the confirmation is recorded.
One sentence, given to everybody who can make a payment. It removes the judgement call, which is the point. Judgement is what fails at half past four on a Friday.
Add a second line for anything above a threshold you choose: two people, one of whom did not receive the original email.
What to do in the first ten minutes if it has happened
Speed matters more than certainty here.
Telephone your bank and ask them to attempt a recall. There is a real chance of recovery in the first hours and very little after a few days. Then telephone the supplier, on a number you already hold, because their mailbox may be the source and email to them may be read by somebody else.
Then check whether anything else moved. Other invoices in the same period, other suppliers with recent changes, and whether any rule was added to your own mailboxes to hide replies. Report it through Action Fraud, and tell whoever supports your IT.
Do not begin by working out who is to blame. The person who reported it quickly did the right thing, and treating it otherwise guarantees the next one gets reported late.
What reduces the chance of it reaching anybody
Multi factor authentication on every mailbox, because most of this begins with a mailbox somebody else can read. Alerts for new forwarding rules, which is how the fraudster stays hidden. And one deliberate conversation with your finance team about the rule above.
None of that is expensive. It is mostly configuration you already own.
Our approach is on the cybersecurity page, and the mailbox side is on Microsoft 365. If you want somebody to look at the settings on your own mailboxes, get in touch and we will tell you what we find.