Specialisms
The invoice looked as it always did – only the bank details were different.
Invoice fraud is not aimed at inattentive companies, but at functioning processes. The invoice arrives at the expected time, through the usual channel, with the correct order number and a matching amount. Only one field has been changed. It is usually noticed only when the genuine supplier chases weeks later – and by then the payment has long since been forwarded.
Circumstances
Clarify the context
Evidence
Preserve documents
Deadlines
Explain any urgency
Approach
Discuss the next steps
Immediate steps
The first hours after a misdirected payment
With this pattern, reaction time matters more than in any other. The funds on the recipient account are as a rule redistributed within a few hours.
Call the bank immediately and demand a recall
Use the telephone, not the contact form, and expressly demand the recall of the transfer as well as contact with the recipient bank. Ask for written confirmation with the date and time of your report. The relevant deadlines for this can be very short and should be asked about at once.
Halt further payments to this recipient
Stop the current payment run and all scheduled orders to the same bank details. At the same time check the supplier’s master-data record and reset it to the verified old connection, so that the next payment does not take the same route.
Reach the genuine supplier through a known channel
Call a number that you know from earlier documents – not the number from the email in question. Clarify whether an attack is known there. Frequently both sides are affected, and the supplier has already seen the same pattern with other customers.
Check mailboxes and access for compromise
Have logins, forwarding rules and registered devices in the mailboxes involved checked, and reset the access credentials from a clean environment. As long as access persists, your internal follow-up is being read as well.
Secure the evidence before anything is tidied up
Secure the original message with full headers, the original and the manipulated attachment, the payment voucher with reference number, the approval logs and the change history in the master-data record. Do not delete any messages, including those that are obviously forged.
File a criminal complaint and document internally
File a criminal complaint and at the same time record internally who granted which approval and when. This documentation is not directed against staff, but is a prerequisite for later clarification vis-à-vis the supplier, the insurer and, where applicable, the bank.
Contact & appointments
Switzerland
Zürich
United Kingdom
London
Estonia
+372 6 288 2000
France
+33 2 04 26 81 82
Netherlands
+31 970 102 51606
Germany
+49 30 41733313
WhatsAppMessage us directly
Send a WhatsApp messageOverview
How a manipulated invoice enters the payment run
Almost always it begins with access to email communication – either at your organisation or at the supplier. The attackers read the correspondence, learn contact persons, wording, order cycles and payment terms, and wait for a genuine invoice. That invoice is intercepted, altered in the attachment and resent from a sender address that differs only slightly. Everything about it is genuine, except the bank details.
One variant does without an invoice. Instead of an altered attachment, accounts payable receives a polite notice that the supplier has changed its bank details – occasionally with the remark that the previous account is blocked because of an audit. The change is entered in the master-data record and then affects all subsequent payments, not only one.
For the affected company this creates two separate problems. The first is the outflow itself and the question of whether the funds are still reachable. The second concerns the relationship with the supplier: a payment to a third-party account regularly does not discharge the liability, so the claim remains open while the amount paid appears lost. Who ultimately bears this loss depends on the specific sequence of events and is frequently disputed.
Recognising the signs
How the manipulation becomes noticeable
The following points can be checked in day-to-day operations and cover the large majority of cases before payment is made.
- The IBAN in the invoice attachment differs from that on earlier invoices from the same supplier.
- The bank details are in a country other than the supplier’s registered seat, without a reason being given for that.
- The sender address differs by a single character – an extra letter, a swapped ending, one more hyphen.
- A reply in an ongoing thread suddenly contains a new circle of recipients or a changed reply address.
- The notice of the account change arrives exclusively by email and presses for rapid implementation before the next payment run.
- The invoice has been newly generated as a PDF and differs in typeface, spacing or metadata from previous ones.
- The supplier chases an invoice that your system records as paid.
Possible measures
Possible measures
Alongside recovery, this pattern always also raises the question of who bears the loss. We treat the two levels separately, because they follow different rules.
Support with the recovery
We draft the requests to your own bank and to the recipient bank, observe the deadlines and document the course of events. A right to information against the payment service provider involved may come into consideration if the recipient is to be identified.
Clarifying the discharging effect vis-à-vis the supplier
Whether the claim has been extinguished by the payment depends, among other things, on whose sphere the attack is to be attributed to and how the account change was communicated. This question is regularly disputed; an examination may be required before a second payment is made or a reminder is accepted.
Examining claims against parties involved
Depending on the facts, claims against the supplier, against an IT service provider or against an institution involved may come into consideration if duties were breached there. That presupposes an evaluation of the contracts and of the technical findings.
Notification to the insurer
Existing fidelity or cyber covers regularly provide for short notification deadlines and policyholder duties. We report the loss in time and accompany the correspondence; the insurer decides on settlement.
Securing the payment process
For the future, an adjustment of the approval rules may make sense – for example telephone verification of every account change via a stored number, a four-eyes principle from a defined amount, and a locked master-data record. We will draft the corresponding specifications with you if requested.
Prospects
How the prospects are to be assessed
Whether the amount can be recovered depends solely on where it is and who holds it. If the misdirected payment is noticed within a few hours, it does happen that part of it is still on the recipient account. After the usual redistribution across several accounts and countries the options decline markedly. A promise as to the outcome is in no case possible, and the time of discovery is the only factor you can influence.
The second level remains open longer. The dispute with the supplier over the discharging effect, possible claims against service providers and the question of insurance cover follow their own rules and their own deadlines. Here there are tangible counterparties, which distinguishes the starting position from pure recovery – a particular outcome does not follow from that either, however.
We tell you at the outset which of the two levels still offers prospects in the specific case and where the effort is no longer proportionate. The overarching account of evidence preservation and payment tracing can be found in the Fraud & Scam practice area.
Frequently asked questions
Frequently asked questions on manipulated invoices
The answers describe the framework. What applies in your case depends on the contractual relationship, the course of the account change and the technical findings.
Related specialisms
Patterns that often overlap
Fraud rarely follows just one pattern. If your case only partly matches, related specialisms may help you understand the connections.
CEO Fraud
Alleged instructions from management to accounts payable – immediate measures, follow-up and responsibility.
Find out moreCybercrime
Data theft, ransomware and attacks on corporate networks – preservation of evidence, notification channels and possible claims.
Find out moreInternational fraud
Cross-border constellations involving several legal systems – jurisdiction, applicable law and enforcement.
Find out more
Related information
Related information
- Fraud and scamsWhen fraud is suspected, payment routes, correspondence and timing are important starting points.
- Recognising signs of fraudUrgency, secrecy and extra payments before a promised withdrawal are recurring warning signs. A single feature does not replace examination of the facts.
- Fraud patterns at a glanceForged invoices, fabricated relationships and manipulated investment platforms follow different patterns. Explore how they work and possible next steps.
- Contact usDescribe your matter in a few sentences. Include only what is needed for the initial contact. Documents can be requested later through a suitable channel.
Contact
Describe your matter
An enquiry does not establish a client relationship or responsibility for monitoring deadlines. If a deadline is approaching, do not rely on this form alone.
- General information. The legal assessment depends on the circumstances of each case.