PayeeGuard

Invoice fraud · checked 23 October 2026

How to prevent invoice fraud

Most invoice fraud succeeds at one moment: someone changes where a payment goes, and nobody checks. Spotting suspicious emails helps, but the controls below work even when the fake email looks perfect.

The eight controls

  1. Call back before any bank-detail change. Use a phone number you already had on file, never one from the email or invoice asking for the change. How to verify a change.
  2. Use a written change process. Changes come in on a form, are checked by one person and approved by another. Free form and policy.
  3. Hold the first payment to new details until the change is verified, or send a small test amount and confirm with the supplier by phone that it arrived.
  4. Separate duties. The person who edits supplier records shouldn't be the person who releases payments.
  5. Clean your supplier list. Remove old and duplicate records and review recent changes. Vendor master file audit.
  6. Use your bank's checks. Name-checking services (UK Confirmation of Payee, EU Verification of Payee) and, in the US, Positive Pay or account-validation services where your bank offers them.
  7. Protect your own email. Two-step verification on every mailbox, and SPF, DKIM and DMARC on your domain so criminals can't easily send as you.
  8. Train for the red flags. Urgency, secrecy, a new account in a different name or country, and a slightly different email address. 12 red flags.

The one rule worth printing

No bank details change on the strength of an email alone. Every change is confirmed by phone on a number already on file, and the confirmation is recorded with the date, who called, and who they spoke to. That record also helps if you later claim on insurance. What insurers ask for.

Payroll too

The same scam targets staff pay: an email "from" an employee asks HR to change their direct deposit. Apply the same call-back rule. Payroll diversion.

If it already happened

Call your bank's fraud line immediately and ask them to recall the payment. Paid a fake invoice? The first 24 hours.

Check a suspicious email free Set up call-backs and approvals