Invoice and Payment Fraud: How to Verify a Request Before Money Moves

Payment fraud does not need malware. A convincing email, message or phone call can be enough if it reaches the right person at the right moment.

AI can make impersonation faster and more convincing, but the core control has not changed: important payment changes should be verified through a channel the attacker does not control.

The common pattern

An attacker impersonates or compromises a supplier, manager or colleague and asks for a payment, bank-account change or urgent exception to the normal process. The request often looks routine because the attacker has copied the language, timing or context of a real business relationship.

Never verify a change inside the same message thread

If a supplier asks to change bank details, call a known contact using a phone number already held in your records. Do not use the number supplied in the suspicious message itself.

Use two-person approval where the amount justifies it

High-value or unusual payments should require a second person to review the beneficiary and supporting request. This creates a deliberate pause when urgency is being used as pressure.

Protect email accounts too

Strong MFA, Conditional Access, email protection and mailbox-rule monitoring reduce the chance that an attacker can work from a legitimate account. But technical controls cannot replace payment verification when the email itself is genuine or convincingly impersonated.

Voice and video are no longer proof on their own

Current NCSC guidance warns that AI can help criminals create more convincing phishing, scams and deep-fake impersonation. A familiar-sounding voice or realistic message should not override the agreed approval process.

If money has already moved

Contact the bank immediately, then your IT/security provider. Preserve the message and timeline, check whether a mailbox was compromised, and report the incident where appropriate.

For the email-account side, read our Business Email Compromise guide. For staff recognition, see our phishing guide.