Invoice Redirection Fraud: Supplier Bank Detail Controls

Invoice redirection fraud succeeds when a criminal persuades an organisation to change a supplier's bank details, so that genuine invoices are paid into an account the criminal controls. It needs no malware on the victim's side, often arrives from a real supplier mailbox and can go unnoticed until the supplier chases an unpaid bill weeks later. This guide covers how the fraud works, the supplier master data and payment controls that stop it, the role of Confirmation of Payee and similar name checks, detection signals and metrics, and how small and large organisations should implement the controls. It is written for finance, accounts payable, procurement, treasury and security teams. When a fraudulent payment has already been made, use the Business Email Compromise Response Playbook.

Key takeaways

The bank detail change is the attack. Treat every request to add or change supplier bank details as a high-risk event that is verified independently of the request, whatever channel it arrives through and however genuine it looks.
Call back on a number you already hold. Verification must use contact details from the supplier master file or the original contract, never those in the request, and must reach a person who can confirm the change.
Separate who changes data from who pays. The person who updates supplier bank details must not be the person who approves or releases payments to that supplier.
Name checks help but do not verify the request. Confirmation of Payee confirms that a name matches an account; it does not confirm that your supplier asked for the change.
Speed decides recovery. The FBI's Recovery Asset Team froze funds in 66% of the Financial Fraud Kill Chain incidents it handled in 2024, so finance teams need a same-hour route to their bank.

How invoice redirection works

The FBI describes business email compromise as "one of the most financially damaging online crimes". Its 2024 Internet Crime Report recorded 21,442 BEC complaints with reported losses of about $2.77 billion. Invoice redirection, also called mandate fraud or supplier impersonation, is the variant that targets accounts payable.

Variant	How the request arrives	Why it is convincing	Control that stops it
Compromised supplier mailbox	Email from the supplier's real address, often in an existing invoice thread	Passes SPF, DKIM and DMARC; correct names, amounts and history	Out-of-band callback on a number held on file
Lookalike domain	Email from a domain one character away from the supplier's	Display name and signature copied; urgent tone	Domain checks, external sender tags, callback
Compromised internal mailbox	A colleague or manager "forwards" new details or asks to rush a payment	Comes from inside; attacker can hide replies with mailbox rules	Change process that does not accept internal email as evidence
Letter or phone call	Letterhead with new details, or a call from "the supplier's finance team"	Paper and voice feel more formal than email	Same verification regardless of channel
Supplier portal or onboarding form	New vendor registration or self-service update with attacker's bank details	Looks like a normal onboarding step	Onboarding verification and a cooling-off period before first payment
Fake new vendor	Invoice from an apparently real company for a service never ordered	Uses a real brand and plausible amounts	Purchase order and goods receipt matching

Attackers who control a mailbox study invoice timing, then send the change request shortly before a large payment is due. They often add inbox rules that move replies to obscure folders (tracked in ATT&CK as T1114.003 Email Forwarding Rule), so neither side sees the warning signs. Email authentication does not settle the question either: in the TruffleNet campaign, stolen cloud credentials and a stolen DKIM key were used to send correctly signed mail from hijacked domains, including a vendor onboarding scam requesting a $50,000 ACH payment.

Supplier master data controls

The supplier master file is the asset under attack. Protect it like a privileged system.

Single change process: all bank detail changes go through one documented workflow in the ERP or AP system. Changes requested by email, phone, letter, portal or a colleague all enter the same queue.
Restricted edit rights: only a small, named group can edit bank fields. Remove the right from buyers, approvers and anyone who releases payments. See the Segregation of Duties Guide.
Dual control on the change: one person records the change, a second person independently performs or reviews the verification and approves it in the system.
Verification record: store who was called, on which number, where that number came from, the date and time, and what was confirmed. Without a record, the control cannot be audited.
Change alerts: notify the supplier relationship owner and the AP lead automatically when bank details change, and send a confirmation to the supplier's previously registered contact.
Cooling-off or first-payment hold: hold or reduce the first payment to new details for a set period, or until the supplier confirms receipt of a small test payment through an independent channel.
Periodic review: review all bank detail changes monthly, and reconcile against supplier statements.

The callback: doing verification properly

A callback is only a control if it is done the right way. The FBI's BEC advice is to verify payment change requests in person or by calling the person, and to "look up the company's phone number on your own".

Do not use contact details from the request. Take the number from the supplier master file, the signed contract or an earlier, verified invoice. If the only number you have came with the request, find one independently from the supplier's official website.
Call a known person, not "accounts". Ask for your usual contact and confirm their identity by referring to a recent transaction.
Confirm the details, not just the change. Read back the old account and ask the supplier to read you the new sort code and account number, or IBAN; do not read the new details to them.
Ask why. Legitimate bank changes usually follow a bank switch, merger or restructuring that the supplier can explain; "our account is being audited" is a common pretext.
Escalate inconsistency. If the supplier denies the request or cannot be reached, freeze the change, alert the supplier that their mailbox may be compromised, and notify security.
Record and approve. A second person reviews the record before the change goes live.

Voice and video can now be faked, so a call from the supplier is not a substitute for a call to the supplier. See the Executive Deepfake and CEO Fraud Guide.

Payment controls and payee name checks

Control	What it does	What it does not do	Best for
Purchase order and three-way match	Pays only invoices matched to an order and a goods receipt	Does not stop a redirected payment for a genuine invoice	Fake vendor and fake invoice fraud
Dual approval on payment runs	Two people approve payment files and high-value payments	Approvers can miss a changed bank field unless it is flagged	All organisations
Changed-details flag in the payment run	Highlights any payment to details changed in the last [90] days	Relies on reviewers acting on the flag	Medium and large AP teams
Confirmation of Payee (UK)	Checks that the account name matches the name the payer entered, with a personal or business account indicator	Does not verify that the supplier requested the change; a mule account in a plausible company name can still match	UK domestic payments
Bank account validation services	Checks account ownership or status against data sources before saving details	Coverage varies by country and provider	Large and international supplier bases
Payment limits and holds	Caps first payments to new details; holds unusual amounts for review	Adds delay to urgent genuine payments	High-value suppliers

Pay.UK describes Confirmation of Payee as an account name-checking service for UK domestic payments, launched in 2020, with expansion mandated by the Payment Systems Regulator in 2024; more than 300 organisations had implemented it, with over 2 million checks a day. Treat a "no match" or "close match" result as a stop signal that triggers a fresh callback, and never accept a supplier's explanation for a mismatch by email. For euro payments, Regulation (EU) 2024/886 on instant credit transfers introduced a verification of payee check; confirm with your payment service provider how and when it applies to your payment types.

Know the limits of reimbursement too. The PSR's reimbursement requirement for authorised push payment fraud, in force for payments from 7 October 2024, covers individuals, microenterprises and charities, up to £85,000 per claim, for Faster Payments and CHAPS transfers. Most businesses are outside it, so prevention is the only protection. See the Authorised Push Payment (APP) Fraud Guide.

Decision guidance: small and large organisations

Small businesses and charities: one rule covers most of the risk: no bank detail change without a phone call to a number already on file, made by someone other than the person who pays. Use the bank's payee name check on every new payee, and have the owner or a trustee approve first payments to new details.
Medium organisations: move bank changes into the accounting system's approval workflow with a separate approver, a changed-details report on every payment run and a first-payment hold.
Large and multinational organisations: centralise supplier master data in a shared service team, use automated account validation, monitor change requests for patterns across business units, and run a supplier-facing notice that you will never accept bank changes by email alone.
Public sector and high-profile buyers: published contract award data tells criminals who your suppliers are and roughly when large payments fall due, so assume targeting and apply the strictest version of the controls.
When to accept delay: the trade-off is speed against certainty. If a supplier insists that a payment cannot wait for verification, that insistence is itself a warning sign.

Where identity and email security fit

Most redirection starts with an account takeover, either at the supplier or inside your own organisation. Phishing-resistant MFA on finance mailboxes, alerts on new inbox rules and forwarding, and blocking legacy authentication shrink the internal side. DMARC at enforcement on your own domains stops direct spoofing of your brand, and lookalike domain monitoring catches registration of near-copies. See the DMARC, SPF and DKIM Guide and the Email Identity and BEC Guide. Do not let any of these replace the callback: a compromised supplier mailbox passes every email check.

Automated finance tools, such as AP automation platforms and AI agents that read invoices, need the same rule: they may extract and propose bank details, but must not be able to change supplier master data or release a payment without a human verification step.

Detection and measurement

Signals to monitor

Bank detail change requests shortly before a large invoice is due, or for suppliers with high recent spend.
New details pointing to a different country from the supplier, to a personal account, or to an account recently used by another supplier.
Several change requests across unrelated suppliers in a short period, which suggests a campaign.
Requests from lookalike domains, newly registered domains or free webmail.
Inbox rules created on finance mailboxes that forward or hide messages containing words like "invoice", "payment" or "bank".
Supplier chasers for unpaid invoices that were recorded as paid.

Metrics

Verification compliance: share of bank detail changes with a complete callback record and second approver (target 100%).
Interceptions: number of fraudulent change requests stopped per quarter, a measure of exposure and of staff vigilance.
Payee check outcomes: share of new payee checks returning close match or no match, and share of those that were re-verified before payment.
Time to report: median time from discovering a misdirected payment to calling the bank; aim for under one hour.
Recovery rate: share of misdirected value recovered.
Edit rights: number of people able to change supplier bank details, reviewed quarterly.

Implementation: a phased rollout

Map the process (weeks 1 to 2). Document every route by which bank details can change today, including email, portals, letters and ERP imports, and who can edit the field.
Close the edit rights (weeks 2 to 4). Restrict bank field editing to a named team and remove payment release rights from that team.
Introduce the verification standard (weeks 3 to 6). Publish the callback procedure, the record template and the second approval step; train AP staff with real examples. Pilot with one entity or supplier segment first.
Add payment run controls (weeks 6 to 8). Turn on the changed-details report and first-payment holds; enable payee name checks with your bank.
Tell your suppliers (week 8). Publish a notice that bank changes are verified by phone and that you will never ask suppliers to change details by email.
Monitor and audit (ongoing). Review metrics monthly and have internal audit test a sample of changes each quarter.

Rollback is straightforward: if a control causes unacceptable delay, relax the first-payment hold threshold rather than removing the callback, which is the one control that must not lapse.

If a payment has gone to a fraudster

Call your bank's fraud line immediately and ask it to contact the receiving bank; report to law enforcement (in the US, IC3, which runs the Financial Fraud Kill Chain for eligible cases; in the UK, the police fraud reporting service); preserve the emails and headers; and warn the supplier. The FBI reports that in 2024 its Recovery Asset Team handled 3,020 Financial Fraud Kill Chain incidents with $848.4 million in attempted theft, freezing $469.1 million domestically and $92.5 million internationally. The full response sequence is in the Business Email Compromise Response Playbook.

Common failure patterns

Calling the number on the letter. A callback to the number supplied in the request verifies nothing.
Trusting the mailbox. Accepting a change because it came from the supplier's real email address, which is exactly what a compromised mailbox provides.
One person does everything. The same clerk changes bank details and releases the payment run.
Exceptions for urgency or seniority. Skipping verification because a director or a large supplier says the payment cannot wait.
Misreading name checks. Treating a Confirmation of Payee match as proof the request was genuine, or overriding a mismatch on the supplier's say-so.
No supplier notification. Never telling the supplier that a fraudulent request was made in their name, which leaves their compromised mailbox active for the next victim.

Framework mapping

Control area	NIST CSF 2.0	NIST SP 800-53 Rev. 5	ISO/IEC 27001:2022 Annex A
Segregation of duties and dual approval of changes	PR.AA-05	AC-5, AC-3(2), CM-5	A.5.3
Supplier relationship and onboarding checks	GV.SC-07	SR-3	A.5.19, A.5.20
Finance staff training on social engineering	PR.AT-02	AT-2(3)	A.6.3
Monitoring of changes and mailbox rules	DE.AE-02	AU-6, AU-12	A.8.15, A.8.16

Related ATT&CK techniques include T1566.001 and T1566.002 phishing used to take over mailboxes, T1534 Internal Spearphishing, T1114.003 Email Forwarding Rule, T1583.001 Domains (lookalike registration) and T1657 Financial Theft.

Practitioner checklist

Route every supplier bank detail change, from any channel, through one documented workflow.
Restrict bank field edit rights to a named team that cannot release payments.
Require a callback to a number already on file, with the supplier reading the new details to you.
Keep a verification record and require a second person to approve each change.
Flag payments to recently changed details in every payment run and hold or cap first payments.
Use payee name checks on every new or changed payee and treat mismatches as stop signals.
Protect finance mailboxes with phishing-resistant MFA and alerts on inbox rules.
Tell suppliers how you verify bank changes, and notify them when their name is used in an attempt.
Keep the bank fraud line and law enforcement reporting route on a card at every AP desk.
Review verification compliance, interceptions and edit rights monthly.

Invoice Redirection and Supplier Bank Detail Fraud Guide: Controls That Stop Payments Going to Fraudsters