Deepak Gupta

Business payment fraud (BEC) · Also called invoice fraud, payment redirection scam, mandate fraud, supplier bank detail change scam, bogus invoice scheme

Vendor invoice and payment redirection

Vendor invoice redirection is a business email compromise scam in which a criminal poses as a supplier, contractor, or tradesperson and says their bank details have changed. The next genuine invoice is paid into the criminal's account instead, and the real supplier is left unpaid.

How it works

Criminals hack or imitate the email account of a supplier, or of the business that pays it, and watch real invoices and conversations.
They send a message, sometimes with a real invoice attached, saying the supplier's bank account has changed.
The paying business or householder updates the details and pays the next invoice to the new account.
The money is then moved on to other accounts, and the real supplier is still waiting to be paid.

Red flags

A supplier's payment details change without warning, especially by email.
The email address or website has a small spelling difference from the one you normally use.
A regular contact suddenly asks to be reached on a new or personal email address.
The message presses you to pay the invoice quickly or keep the change quiet.

If you are targeted

Stop: do not make any more payments to the new bank details.
Call your bank at once and ask it to recall the payment; the FBI also suggests asking for a Hold Harmless Letter or Letter of Indemnity.
Contact the real supplier on a phone number you already have to confirm what happened.
Report it. Our Report a scam page lists where to report in your country, such as ic3.gov and ReportFraud.ftc.gov in the US.

Where to report, by country

Prevention

For individuals

Before paying a builder, solicitor, or other trader whose bank details have changed, call them on a number you already have.
Never use the phone number or link in the email that announces new bank details.
Check the sender's address carefully for extra letters or numbers.

For organisations

Verify every change to supplier bank details by calling a contact on the number already in your supplier records, never one supplied with the change.
Require a second person to sign off any change to supplier bank details before it takes effect.
Hold the first payment to changed bank details until the change has been confirmed, and treat unusual invoices or amounts as a reason to check.

By the numbers

Figures are for the reporting category this scam falls under, not this scam alone.

Business email compromise losses reported to the FBI IC3 in 2025	$3.05B	US, 2025, FBI IC3
Payment redirection scam losses reported in Australia in 2025	A$166.8M	AU, 2025, ACCC

Real cases

2019-12 · US · Sentenced · $122M stolen
Evaldas Rimasauskas sentenced for fake invoice fraud on Google and Facebook, 2019
2019-08 · JP · Disclosed · ¥4B estimate
Toyota Boshoku European subsidiary hit by payment fraud, 2019

Delivered through: Spear phishing, Email phishing

How official datasets classify it

FBI IC3: Business Email Compromise
UK Finance: Invoice & mandate scam
Scamwatch: Business email compromise scams
MITRE ATT&CK: T1684.001, T1657

Questions

A supplier emailed to say its bank details have changed. What should I do?: Do not pay until you have called the supplier on a number you already have, not one from the email. Scammers often send these messages from hacked or look-alike accounts.
We paid a fake invoice. Can we get the money back?: Call your bank immediately and ask it to recall the payment, then report it at ic3.gov or your national reporting service. Speed matters.