CyberGlossary

Attacks & Threats

Invoice Fraud

Also known as: Mandate fraud, Payment diversion fraud, Supplier fraud

Definition

A fraud in which attackers submit fake invoices, or alter genuine ones, so that payment is routed to attacker-controlled bank accounts.

Invoice fraud sits at the intersection of business email compromise and accounting controls. The attacker either spoofs a vendor address, hijacks the vendor's real mailbox, or registers a look-alike domain, then sends a payment-redirection notice or a doctored PDF invoice changing the IBAN/SWIFT details to their own. Sophisticated variants insert themselves into existing email threads ("thread hijacking") and target finance precisely when a real invoice is expected. Defences include verifying bank-detail changes by callback to a previously known phone number, supplier master-data controls, dual-approval payment workflows, DMARC reject, and warnings on external/lookalike-domain emails.

Examples

  • A look-alike supplier domain emails finance with "updated" bank details just before a quarterly payment.
  • A hijacked supplier mailbox replies to an open quote thread attaching a PDF with the attacker's IBAN.

Related terms