Invoice fraud uses a false, altered, duplicated or misdirected invoice to obtain an unauthorized payment or financial benefit. It can involve an external criminal, dishonest supplier, compromised account or internal collusion.
What forms can it take?
- Changed beneficiary bank details
- Fictitious supplier or invoice
- Duplicate invoice or repeated payment
- Inflated quantity, price or fee
- False goods or service evidence
- Compromised email requesting urgent payment
Which warning signs matter?
Watch for unexpected account changes, new domains, urgency, secrecy, unusual currency, mismatched supplier identity, round amounts, missing purchase orders and invoices that bypass normal contacts.
How should bank-detail changes be controlled?
Independently contact an authorized supplier representative using a known channel, verify the beneficiary name and account, require appropriate approvals and retain the evidence. Do not rely on contact details inside the change request.
What controls reduce risk?
Use supplier onboarding, duplicate checks, purchase-order and receipt matching, segregation of duties, dual approval, anomaly screening and payment limits. Controls should cover manual and system-generated invoices.
What should happen after detection?
Stop unreleased payments, contact the financial institution promptly, preserve messages and logs, restrict compromised access, notify responsible teams and follow legal or regulatory reporting requirements.
