Payment-change verification controls that stop invoice fraud

The fraud pattern

Invoice and payment fraud usually relies on a believable request rather than malware: a vendor’s compromised mailbox or a lookalike domain asks finance to update bank details, or an executive impersonator requests an urgent transfer. Technical filters catch some of it; process controls catch the rest.

Controls that work

Require any change to vendor bank details to be verified by calling a number already on file, never one from the requesting email. Require two people to approve payments above a threshold and any first payment to new details. Tag external email clearly in the subject or banner, and warn on lookalike sender domains.

• Callback to a number already on file
• Dual approval above a threshold
• Hold period for new bank details
• External sender banners and lookalike warnings
• Training with real anonymized examples

Lab: tabletop a bank detail change

Write a one-page procedure for vendor bank detail changes in your organization, or a hypothetical one. Then walk through a scenario: a known vendor’s real address emails new bank details with an invoice due today. Mark where each control would stop the payment, and identify any path where one person could bypass all of them.

scenario: vendor mailbox compromised, new IBAN, invoice due today
control                        | stops it? | notes
external banner                | no        | sender is the real vendor
lookalike warning              | no        | not a lookalike
callback to number on file     | yes       | vendor confirms no change
dual approval for new details  | yes       | second approver requires callback evidence
5-day hold on new details      | yes       | buys time for verification

If money was sent

Speed matters: contact your bank immediately to request a recall, report to law enforcement through the national channel such as IC3 in the United States or Action Fraud in the UK, preserve the emails, and check whether the vendor or your own mailbox was compromised.