Invoice Fraud: The Controls That Actually Stop It
Priya Sharma
· Corporate Legal & Compliance Counsel· 3 min read
Invoice fraud in Indian businesses rarely involves a forged document. It involves a genuine invoice for genuine work, with the bank details altered, sent from an address that looks exactly like your supplier's — because it often is your supplier's.
- ✓Business email compromise is the dominant vector, not forged documents.
- ✓Verify bank detail changes through a channel other than the one requesting it.
- ✓Segregate the ability to change vendor masters from the ability to approve payments.
- ✓Penny-drop verification at onboarding catches most account mismatches.
How it works
An attacker compromises a mailbox at the supplier or the buyer, watches the correspondence until an invoice is due, and then sends a message advising that bank details have changed. The invoice is real, the amount is right, the context is correct, and the account is theirs.
Variants include a lookalike domain differing by one character, and a reply-to address that differs from the display name. Both survive casual inspection.
The controls that work
The telephone verification is the single highest-value control and the one most often skipped under time pressure, which is precisely when the request arrives.
- Verify every bank detail change by telephone, on a number from your own records rather than from the request.
- Require two approvals for any vendor master change, separate from payment approval.
- Penny-drop verification at onboarding, matching the account holder name to the vendor.
- A mandatory cooling period between a bank detail change and the next payment to that vendor.
- Payment limits requiring additional authorisation above a threshold.
Segregation of duties
The person who can change a vendor's bank account should not be the person who can approve a payment to that vendor. In small finance teams this is difficult, which is why the compensating control — verification through an independent channel — matters more.
Review the audit log of vendor master changes monthly. Unexplained changes are visible there before the payment leaves.
If it happens
Act within hours. Contact your bank immediately to attempt recall, file a complaint on the National Cyber Crime Reporting Portal, and report to the local cyber cell. Preserve the emails with full headers rather than forwarding them.
Recovery rates fall sharply after the first day, because funds are typically moved onward quickly.
Frequently asked questions
### What is business email compromise?
An attack where a mailbox is compromised or impersonated and used to redirect a genuine payment. The invoice and amount are real; only the bank details are altered. It is the dominant form of invoice fraud because it defeats document-based checks.
### How should bank detail changes be verified?
By telephone to a number already in your records — never a number supplied in the request itself. Combine this with dual approval for vendor master changes and a cooling period before the next payment.
### What should I do if a payment goes to a fraudulent account?
Contact your bank within hours to attempt recall, file on the National Cyber Crime Reporting Portal, and report to the local cyber cell. Preserve the original emails with full headers. Recovery becomes considerably harder after the first day.
Related Dyopact Tools & Templates
Frequently Asked Questions
What is business email compromise?
An attack where a mailbox is compromised or impersonated and used to redirect a genuine payment. The invoice and amount are real; only the bank details are altered. It is the dominant form of invoice fraud because it defeats document-based checks.
How should bank detail changes be verified?
By telephone to a number already in your records — never a number supplied in the request itself. Combine this with dual approval for vendor master changes and a cooling period before the next payment.
What should I do if a payment goes to a fraudulent account?
Contact your bank within hours to attempt recall, file on the National Cyber Crime Reporting Portal, and report to the local cyber cell. Preserve the original emails with full headers. Recovery becomes considerably harder after the first day.
Priya Sharma
Corporate Legal & Compliance CounselSpecializing in commercial contract litigation, Section 138 NI Act recovery, commercial property leases, and MSMED Act compliance.