A regular vendor sends their monthly invoice. The logo, items, and payment terms look completely normal. Your team schedules the transfer and pays it on time.
Weeks later, the vendor calls to ask where their money is. You check your bank account. The money left your account weeks ago, but the vendor never got paid.
This is the classic sign of business email compromise (BEC). Fraudsters do not always need complex malware to steal your money. Instead, they use simple deception to run invoice redirection scams. They slip into normal email chats, change bank details, and quietly steal company funds.
Learning how invoice fraud works helps you spot red flags early. It keeps your payment process secure and protects your company’s cash flow.
What is business email compromise (BEC)?
Business email compromise is a type of cybercrime where scammers target companies to steal funds or confidential corporate data. Rather than targeting individual consumers, criminals focus on businesses of all sizes, from online stores to large enterprises.
How BEC differs from mass phishing
Most people know standard spam and phishing emails. These messages go out to thousands of people at once. They usually contain obvious typos, broken links, or generic greetings.
BEC scams work differently. Scammers research your company first. They study your team on LinkedIn, read your company news, and find out who handles your finances. Then, they use social engineering to build trust. They write personalized emails that look just like routine office messages.
Because these emails look real, staff rarely suspect anything is wrong. Teaching your team how these tricks work helps you avoid common fraud schemes before money is lost.
Open an account
in Genome online
The mechanics of invoice redirection
One of the most common forms of BEC is payment redirection. In this scam, a fraudster steps into a regular billing conversation between a buyer and a seller.
The scammer sends a modified invoice that lists their own bank account. The buyer pays it, believing they are paying their real partner.
This scam is dangerous because your team sends the money willingly.
Banks see a normal transfer, so automated security rarely flags it. Once the funds land, scammers quickly move them abroad or convert them into crypto. Getting that money back is almost impossible.
Step-by-step: how invoice redirection scams unfold
Invoice redirection attacks are rarely rushed. Scammers often spend weeks planning before they ask for money.
Step 1: Quiet reconnaissance and mailbox access
The attack begins when a scammer breaks into a company email account. They usually get in through a phishing link, leaked password, or malware.
Once inside, they stay quiet. They do not change passwords right away. Instead, they set up hidden forwarding rules. Copies of new invoices, contracts, and vendor emails go straight to the criminal’s inbox. They spend weeks learning your billing cycles and payment habits.
Step 2: Intercepting the legitimate billing cycle
Next, the scammer waits for the right moment. This usually happens when a regular vendor is ready to send an invoice.
Attackers typically use two methods to send the bill:
Direct mailbox takeover: They send the fake invoice straight from the vendor’s real, hacked email account.
Lookalike domains: They buy a web domain that looks almost identical to the vendor’s real address. For example, they might swap one letter or add an extra word. Then, they email your team and continue the old conversation.
Step 3: The revised bank details and manufactured urgency
The scammer attaches an invoice with new supplier bank details. This bank account belongs directly to the criminal.
To stop staff from asking questions, the scammer provides an excuse. They might say their bank is undergoing an audit, or that they switched banks to speed up transfers.
They also push for speed. They might say deliveries will pause or fees will apply if you do not pay today. Rushed employees often skip verification to avoid business delays.
When BEC meets advanced fraud tactics
Criminals do not rely on email alone anymore. They now combine email tricks with phone deception.
Layered attacks: combining emails with synthetic voice
Modern invoice scams often mix fake emails with phone calls. If your finance team calls to confirm new bank details, fraudsters are ready.
Using AI tools, scammers can clone an executive’s voice using audio clips from social media or online webinars. A member of your team might receive a follow-up call from someone who sounds identical to the vendor’s director, confirming the new bank account.
This mix of email and voice tricks creates strong false trust. Our guide on deepfake and AI voice-cloning fraud explains how to protect your team against multi-channel attacks.
Telltale red flags of invoice redirection
Scammers almost always leave small clues. Train your team to watch for these warning signs:
Slight domain misspellings: Check the sender’s email address carefully. Look for swapped letters, tiny typos, or unusual domain endings.
Last-minute bank changes: Be cautious whenever a regular partner asks to be paid at a new bank account.
Mismatched countries: If a local supplier asks you to send funds to an account in a different country, stop and investigate.
Urgent demands: Scammers want you to act fast without thinking. Any pressure to bypass standard approval steps is a major red flag.
Visual changes on the invoice: Watch for changed fonts, shifted logos, or new phone numbers on the document.
Excuses to avoid phone calls: Be suspicious if the sender insists on email only because they are “in meetings all day.”
How to protect your business: actionable defense protocols
Technology alone cannot stop invoice scams. Strong companies combine smart security habits with strict payment rules.
Out-of-band verification (the golden rule)
Set one strict rule for your team: Never change supplier payment details based on an email alone.
Always confirm changes through a separate, trusted channel:
Call the supplier using a trusted phone number you already have on file.
Never call the phone number printed on the new invoice or written in the suspicious email.
Speak directly with a known contact and have them confirm the account number out loud.
Dual authorization and internal approval limits
No single employee should have the power to send large company payments by themselves.
Set up simple internal controls:
Separate duties: Have one person draft the payment and a manager review it.
Dual sign-offs: Use dual approval rules for any transfer over a set financial limit.
Strong logins: Require two-factor authentication (2FA) for all work email and banking tools.
Learn how to protect your account with strong security habits and clear team permissions.
Verification of Payee (VoP) checks
Banking technology can also catch fraud before money leaves your account.
With Verification of Payee (VoP), the banking system automatically checks the name you type against the official name on the recipient’s bank account. If the names do not match, the system alerts you right away so you can stop the transfer.
Built-in payment security with Genome
Protecting company funds requires reliable, transparent banking tools. Genome delivers secure business accounts designed to give corporate teams total control over their money.
As an Electronic Money Institution (EMI) supervised by the Bank of Lithuania, Genome follows strict European security rules to keep your business safe.
A Genome business account gives you practical tools to stop fraud:
Custom team roles: Set up specific roles for your staff with a shared business account feature. Let team members prepare payments, while saving final approvals for company directors.
Mandatory two-factor authentication (2FA): Protect every outgoing SEPA, SEPA Instant, and SWIFT transfer with strong login checks and biometrics.
Multi-currency accounts: Hold and manage 12 currencies (EUR, USD, GBP, PLN, CHF, JPY, CAD, CZK, HUF, SEK, AUD, and DKK) in one clean dashboard with complete visibility.
Open an account
in Genome online
Final thoughts on stopping invoice fraud
Invoice redirection scams target busy teams and daily routines. This is why you need to confirm bank updates over the phone and set up dual approval rules for large transfers.
And, of course, partnering with a reliable financial institution to get a business account is also crucial. See for yourself – apply for a business wallet inside Genome today.
