Why the message can look completely normal
An attacker may imitate a supplier, register a similar domain or control a genuine mailbox. That access provides real names, invoice timing, writing style and prior conversation. Grammar and branding are therefore weak safety tests.
The decisive signal is often procedural: a new account, unusual currency, pressure to pay quickly, a reason not to call, or a request to ignore the established approval path. Treat the change itself as untrusted until verified.
Signals hidden inside a plausible request
| Signal | Attacker's explanation | Control that resists it |
|---|---|---|
| New bank account | Audit, banking problem or new treasury account | Call a known supplier contact and read back the details |
| Urgent deadline | Shipment, penalty or month-end close | Preserve the normal approval sequence |
| New country or currency | Regional office or better rate | Require contract and master-data review |
| Do not contact usual person | They are traveling or unavailable | Escalate to another independently sourced contact |
| Split payments | Limit or processing convenience | Require a documented commercial and compliance reason |
Design a change-control process
Separate vendor master data from invoices
Staff who process invoices should not silently replace stored bank details from an email attachment.
Verify out of band
Use a phone number already in the vendor record or a known account manager, not the contact information in the change request.
Require dual approval
One person verifies and records the change; another reviews the evidence before the first payment.
Notify the supplier
Send confirmation through the established channel after the master data changes so unexpected activity can be challenged.
Example: the one-letter domain
A supplier email appears in a continuing thread, but the domain contains one substituted character. The attached invoice is genuine except for the beneficiary account. The payment team recognizes the account change and calls the supplier using the number in its vendor file.
The supplier confirms no change. The team blocks the sender domain, preserves the message for security review and warns staff who might receive a similar request. No money moves because the control relies on process rather than visual detection alone.
Build the control around a compromised mailbox
Assume an attacker may read a real email thread, copy an invoice and imitate the normal writing style. Keyword warnings and visual inspection are not enough. The control should activate when beneficiary details change, a new account appears, an unusual intermediary is introduced or normal approval timing is compressed.
Verify the change through a channel that the payment request did not supply. Use a previously stored number or known contact, read back the full beneficiary name and account details, and record who confirmed them. Separate commercial approval from bank-detail approval so one compromised mailbox cannot both request and authorize the payment.
After verification, preserve the old and new instructions with the approval record. If the change is false, stop the payment, secure affected accounts and warn others who may receive the same request. If money has already moved, report it immediately to the bank and provider. Do not continue the email conversation as the primary recovery channel because the attacker may still control it.
Turn awareness into controls
Use the recipient verification call for every first or changed payment.
Build the business workflow in payment approval controls.
Invoice-fraud and verification sources
FTC and payment guidance support the separate-channel verification process used here. Treat every changed beneficiary instruction as unverified until a known contact confirms it.
Questions that expose a changed invoice
Can a genuine mailbox send a fraudulent invoice?
Yes. Mailbox compromise can let an attacker use a real account and conversation history.
Does a valid company name on the bank account prove safety?
No. Name checks have limits and do not establish that the invoice or change request is legitimate.
What should happen after payment?
If fraud is suspected, contact the sending provider and bank immediately, preserve evidence and report through the relevant local channels.
This page uses worked reasoning and authoritative references; it does not claim first-hand testing or personalized advice. See our editorial policy.
Use this alongside the cross-border money safety collection to verify recipients, changed instructions and recovery evidence.