Invoice fraud and fake payment requests: how an SME should set up payment checks

How invoice fraud gets in

In invoice fraud, someone tries to get you to pay into an account that does not belong to the real recipient. In an SME this usually happens in one of three ways:

• changed bank account number: a message that appears to come from a known supplier announces a new bank account number, often with a neat letter or an adjusted invoice;
• director fraud: someone poses as the director or another manager and asks for a quick, confidential payment, often at a moment when that person is hard to reach;
• compromised mailbox: an attacker has access to a real mailbox, yours or a supplier’s, reads ongoing conversations and steps into an existing email thread about an invoice at the right moment.

That last form is the hardest to spot, because the message really does come from the right address. No spam filter stops it. That is why the payment agreement within your business is the most important defence.

The payment check you agree on

A good payment check is short enough to always follow, even when things are busy:

• check through a second channel: always verify a new or changed bank account number by phone, on a number that was already in your records or on the supplier’s website, never on the number in the message itself;
• two people for exceptions: a payment above a fixed amount, a first payment to a new account or an urgent request is approved by a second person;
• no exception for the director: agree in advance that the director never asks for a secret urgent payment by email or chat, so employees can refuse such a request without awkwardness;
• the bank’s name check: pay attention to your bank’s warning when the recipient’s name does not match the account number, and do not go ahead without calling;
• record it: when a bank account number changes, note who checked it, when and who they called.

Urgency, secrecy and a new bank account number together are the clearest warning sign. Teach the team that this exact combination is a reason to slow down, for example in security awareness training.

What technology adds

Technology does not prevent every attempt, but it makes an attacker’s job a lot harder. Multi-factor authentication on all accounts means a stolen password is not enough to take over a mailbox. A block on automatic forwarding to external addresses stops an attacker from quietly reading all your email. With SPF, DKIM and DMARC you make it harder to send email that appears to come from your own domain, and an external email warning banner shows when a message comes from outside while it looks like an internal colleague.

Also keep an eye on risky sign-ins. A compromised mailbox often starts with a sign-in from an unknown location and a new rule that moves or hides messages.

What to do if you have already paid

If you discover that a payment went to the wrong account, every hour counts:

• call your bank straight away and ask whether the payment can be stopped or recalled;
• report it to the police and to the Dutch Fraud Helpdesk (Fraudehelpdesk);
• have someone check whether a mailbox has been taken over, change the passwords and revoke the active sign-ins;
• warn the real supplier, because their mailbox may be the source;
• assess whether there is a data breach: if the attacker had access to a mailbox with personal data, you decide within 72 hours whether to report it to the Dutch Data Protection Authority.

What to sort out this month

Keep the first step small enough to actually carry out:

• write the payment check on one page and go through it with everyone who prepares or approves payments;
• set up your banking environment so payments above a fixed amount need approval from two people, if your bank supports it;
• check that multi-factor authentication is on for all accounts, including those of the finance team;
• check that automatic forwarding to external addresses is blocked;
• store the phone numbers of your main suppliers in your records, so you never have to rely on the number in an email.

What not to do on day one: have the director review every single payment. Nobody keeps that up. Focus the extra check on the moments with the most risk: a new bank account number, a first payment and an urgent request.

How Floor ICT sets this up — and what you decide

Floor ICT turns on multi-factor authentication for all accounts, blocks automatic forwarding to the outside, sets up SPF, DKIM and DMARC for your domain and keeps an eye on risky sign-ins. If invoice fraud is suspected, we investigate whether a mailbox has been taken over, shut it off and find out which rules or forwarding settings an attacker created.

You decide which payment check you use, from which amount a second person reviews and who may approve payments. Contact with the bank and the decision on a data breach report stay with you; we provide the technical facts about what happened in the mailbox.