Invoice redirection fraud is a payment scam where an attacker tricks a business into sending money to a fake account instead of the real supplier. Technically, it relies on account takeover, phishing, spoofed email, or compromised supplier identities to change bank details during invoice approval and payment workflows.
What Invoice Redirection Fraud Means
Invoice redirection fraud is not a payment failure in the technical sense, but a trust failure in the invoicing workflow. The attacker’s goal is to intercept a legitimate payable process and replace the supplier’s real bank details with account information they control.
Because the fraud usually arrives through a normal business process, it often blends into routine accounts payable activity. The scam works by exploiting assumptions that invoice emails, supplier requests, and payment-change messages are authentic unless proven otherwise.
The core danger is that the business believes it is paying a real supplier, while the funds are actually diverted to an unauthorised destination. That makes the fraud financially damaging and also harder to detect quickly, especially when the payment request appears to come from a familiar contact or approved workflow.
How the Scam Works Across Email and Payment Workflows
Invoice redirection fraud commonly begins with phishing, mailbox compromise, or spoofed correspondence. Once the attacker can influence a trusted communication channel, they send a change-of-bank request, alter remittance instructions, or impersonate a supplier during invoice approval.
The most effective attacks do not need to break the payment platform itself. They target the people and processes around it, especially where supplier records can be updated, exceptions can be approved, or urgency can override normal verification.
This is why the scam is often linked to Email Identity and BEC Guide controls such as email authentication, mailbox takeover prevention, and payment verification. It is also closely related to supplier-bank-change scenarios covered in the Authorised Push Payment (APP) Fraud Guide, where scammer-controlled accounts receive funds through manipulated payment instructions.
When suppliers, finance teams, and approvers share the same trust assumptions, the fraud can cross those boundaries quickly. A compromised mailbox, a lookalike domain, or a fraudulent phone callback can be enough to make the changed payment details look legitimate.
Why Exposure Often Goes Unnoticed
Exposure usually comes from weak verification rather than a single obvious technical defect. Businesses are most vulnerable when supplier onboarding, invoice approval, and payment release are handled by separate people who do not independently validate changes to banking details.
Risk also increases when email security controls are incomplete, when shared inboxes are used, or when accounts have broad access to payment files and supplier master data. In those environments, a single compromised identity can influence several steps in the process.
Small Business Identity and Access Security Guide is relevant here because strong MFA, tight admin access, and better account hygiene reduce the chance that an attacker can reach the mailbox or finance system used to execute the scam. The same exposure pattern often appears in compromise-led fraud incidents, where the attacker’s real advantage is access to trusted communication and approval channels.
What Good Detection and Response Look Like
Detection should focus on changes, not just payments. A sudden bank-detail update, an urgent payment request, a new forwarding rule, a suspicious login, or a last-minute change in delivery instructions can all be indicators that invoice routing has been manipulated.
Post-incident review should confirm whether the email account, supplier contact, or finance workflow was compromised before the payment was authorised. If the compromise involved mailbox access, session theft, or stolen credentials, the organisation should treat the event as both a fraud case and an identity-security event.
The Business Email Compromise Response Playbook is useful because it aligns the response with payment recall, mailbox containment, and recovery steps after fraudulent instruction changes. For external reporting and suspicious transaction escalation, authoritative guidance from FinCEN can also help organisations coordinate financial-crime reporting and response paths where US obligations apply.
How Organisations Reduce the Fraud Surface
Prevention depends on layered verification. The most effective control is to separate invoice receipt from payment-change approval, then require out-of-band confirmation for any change to bank details, supplier master data, or remittance instructions.
Organisations should also harden email authentication, protect privileged mail and finance accounts, and review access to supplier records and payment workflows. Where suppliers are onboarded or revalidated, the change should be checked against a known-good channel rather than the message requesting the change.
For broader control mapping, NIST SP 800-53 Rev 5 Security and Privacy Controls provides a useful control catalogue for access control, auditability, and system integrity, while OWASP API Security Top 10 becomes relevant when supplier or payment systems expose APIs that can be abused to alter account data. In cloud-connected environments, NIST Cybersecurity Framework 2.0 is a practical way to organise prevention, detection, response, and recovery around the workflow that the scam targets.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Invoice fraud often starts with stolen credentials or mailbox access that must be rotated and managed. |
| AC-6 — Least Privilege | Payment and supplier-change workflows are safer when access is limited to only the duties required. | |
| AU-6 — Audit Review, Analysis, and Reporting | Invoice redirection fraud leaves reviewable evidence in mail, payment, and master-data activity logs. | |
| Recommendation — Rotate and revoke compromised credentials quickly, and enforce controlled lifecycle management for all authenticators. Restrict finance and supplier-record permissions to the minimum access needed for each role. Review logs for payment-detail changes, mailbox rules, and unusual approval activity to detect fraud. | ||
| CIS Controls v8 | CIS-5 — Account Management | The scam depends on compromised or misused accounts that can alter trusted payment instructions. |
| CIS-8 — Audit Log Management | Detection relies on logs from email, identity, and payment systems that show the fraud path. | |
| Recommendation — Harden account governance so compromised or overbroad accounts cannot alter supplier payment details. Centralise and review logs for mailbox compromise, instruction changes, and payment approval anomalies. | ||