Invoice Fraud Prevention: Stopping Fake Bank-Detail Emails Before Payment

Invoice fraud prevention is a process, not a product. Before money moves, every request to change supplier bank details needs to be confirmed by phone, using a number you already have, by someone in your business. Don’t use the number in the change-request email.

For builders, this check is one part of good construction IT support Manny Rahat, alongside protecting email accounts and setting clear payment approvals. The aim is straightforward: make it difficult for a fake invoice email or bank detail change fraud to slip through during a busy payment run.

How the scam actually works

Payment redirection fraud is when someone tricks your business into sending a legitimate payment to the wrong bank account. The invoice may look genuine. The supplier may be real. The change is in where you’re asked to send the money.

There are three common ways this can happen:

• A supplier’s mailbox is compromised. A criminal gains access to the supplier’s email and sends an invoice, or replies in an existing conversation, with different bank details. Because the message comes from the genuine account, the email address and history may look right.
• A lookalike email address is used. The sender creates an address or domain that closely resembles the supplier’s real one. They may copy a real invoice and ask you to use a new account. A small spelling difference can be easy to miss.
• An account in your business is compromised. Someone gets access to an employee’s mailbox and watches conversations about invoices. They may then send a convincing message from that employee’s account, or alter the supplier’s payment details inside your process.

In each case, the criminal is trying to get between your business and a payment that was already due. They may create urgency, claim an account is being closed, or ask you to keep the change confidential. Treat any new bank details as unconfirmed until your own check is complete.

Why construction is targeted

Construction businesses manage payments across many suppliers and subcontractors. A project can bring new businesses into the process, while invoices may be checked by different people across the office and site.

Payment runs can also happen under pressure. An accounts person may be reconciling a stack of invoices, responding to a site manager and trying to meet a deadline. A message viewed on a phone in a site shed can be harder to scrutinise than one checked at a desk.

Invoices may involve substantial ex GST amounts, but the process matters regardless of value. A small payment can still expose a weak approval step. The same gap can affect the next invoice, a different supplier, or a future project.

The rule that stops it

Before changing supplier bank details, call the supplier using a number already saved in your records or on an existing contract. Don’t call a number included in the email, even if the message appears to come from a familiar contact.

Ask the supplier to confirm the change verbally. Record who you spoke to, when you called and what was confirmed. Keep that record with the supplier update or invoice.

Use a second person to approve changes to bank details. Where practical, make sure the person who checked and entered the change isn’t the only person approving the first payment to the new account.

Tell your suppliers how you handle changes. Make clear that your business won’t accept a bank change by email alone. Ask them to confirm requests through a known contact and contact your business if they receive an unexpected request that appears to come from you.

The technical layer

Good checks by staff are essential. Technical controls help protect the email accounts those checks rely on.

• SPF, DKIM and DMARC are settings that help receiving email services check whether a message is allowed to come from your business’s domain. They make it harder for someone to send a message pretending to use your exact domain. They don’t prevent someone from using a lookalike domain or a compromised supplier account.
• Multi-factor authentication (MFA) requires an extra proof of identity, such as an approval on a phone, as well as a password. Turn it on for all email accounts, especially those used by accounts, directors and staff who approve payments.
• Avoid shared mailboxes for individual logins. Give staff their own accounts and access to the mailboxes they need. This makes it easier to see who signed in and to remove access when someone leaves.
• Alert on new forwarding rules. Criminals may set a mailbox to forward or hide certain messages, so they can monitor a conversation without obvious signs. Your IT provider can check for unusual rules and configure alerts, and it is worth having a tested backup in case messages are deleted or a mailbox is locked.
• Watch for lookalike domains. A near-match to a supplier’s domain can fool someone scanning a busy inbox. Staff should pause when a message changes payment details, even if the sender’s name looks familiar.

These controls lower the chance of email being abused, but they don’t replace a phone check. A genuine supplier mailbox can be compromised, and a carefully crafted fake can look convincing.

If you think a payment has gone out

Act promptly, but don’t assume recovery is guaranteed. In the first hour:

1. Call your bank using its official number. Explain that the payment may have been redirected and ask what steps are available. Give them the payment details and any reference information.
2. Stop other payments that may be affected. Check whether the same supplier details were used elsewhere, and pause any pending payment to the changed account until verified.
3. Tell your IT provider. Ask them to secure any affected mailboxes and preserve relevant evidence, including emails, invoices, login records and mailbox rules. Avoid deleting messages or resetting devices before evidence can be retained.
4. Contact the supplier using a known number. Confirm whether their email account or payment details were compromised, and agree on a safe way to communicate.
5. Notify your insurer and report the incident to police through ReportCyber. Follow your insurer’s incident process and keep a record of who you contacted and when.

If an employee’s mailbox may be involved, secure it and check for unfamiliar sign-ins, forwarding rules and sent messages. Use a separate, trusted channel to coordinate the response.

A simple process your office can run

Put this procedure in writing and make sure anyone handling invoices knows where to find it.

1. Receive the invoice. Check that the supplier, amount, purchase and payment details match your records. Don’t assume a familiar email thread makes a change safe.
2. Flag any new or changed bank details. Pause the payment. Mark the supplier record as needing verification so another person doesn’t process it by mistake.
3. Call a known number. Use a number from your supplier records, contract or previous verified correspondence. Never rely on the contact details in the change request.
4. Record the confirmation. Note who confirmed the details, when, and the number used. Keep the note with the invoice or supplier record.
5. Get a second approval. Have another authorised person approve the bank-detail change before it is saved. Use your normal payment approval rules for the first payment.
6. Update the supplier record securely. Limit access to the people who need it. Keep a record of who made and approved the change.
7. Review the process regularly. Check who can edit supplier details, who approves payments and whether staff know how to report a suspicious email.

Invoice fraud prevention works best when the same steps apply every time, including when a request seems urgent or comes from a known contact. A pause and a call can give your team a chance to catch a payment redirection scam before the money leaves the account.

MTR IT helps builders lock down mailboxes and put bank-change checks in place across Melbourne. Call 03 9087 4390. For what a properly covered IT setup should cost, read our free guide on what good IT support should cost.