Fake invoices and "our bank details have changed" emails

Short answer: Treat any email that changes where you send money as suspicious until you've confirmed it by phone, using a number you already had or the supplier's publicly listed one, never the number in the email. Write that rule into a short payment-change process so nobody has to decide on the spot, protect your own mailboxes with two-factor sign-in, and if you have already paid, ring your bank straight away, because speed is what gives the money a chance of coming back.

How the scam usually plays out

A hypothetical example, with the details typical of these cases. A Christchurch building firm has bought timber from the same supplier for years. One Tuesday, the accounts person gets an email from the supplier's usual contact: same name, same signature, replying to a real thread about last month's order. It says the supplier has moved banks and attaches a letter with new account details. This month's invoice, for the right amount, is attached too. It's paid on Thursday. The real supplier chases payment three weeks later.

What happened behind the scenes is called business email compromise. New Zealand's Own Your Online guidance describes it as an attacker getting into someone's email account without permission, most often by obtaining the password through phishing, password guessing or leaked password lists. Once inside, they read billing conversations and either send fake invoices or intercept genuine ones and change the payment details. Sometimes it's your supplier's mailbox that's compromised; sometimes it's yours, and your customers receive the fake bank details.

A second variant uses a lookalike address rather than a hacked mailbox: an extra letter in the domain, a swapped "rn" for "m", or a free webmail address with the supplier's name.

Warning signs

Any one of these is reason to stop and check:

The payment details change. Own Your Online's advice is blunt: if an email or invoice asks you to change bank account details, be suspicious immediately.
Urgency or secrecy. "Please process today", "the director is travelling, don't call".
A slightly different address. Compare the sender's address with the one on their website and in past emails. Check that the part after the @ actually matches the organisation's domain.
Reply-To doesn't match From. Hit reply and look at where it's really going.
The letter looks official but arrives as an attachment rather than through your supplier portal or the normal channel.
Small differences from the last invoice: a new layout, different invoice number pattern, a new reference format.
An unexpected invoice for goods or services you didn't order.

None of these signs is proof on its own, and a well-run scam can avoid all of them. That's why the process below doesn't rely on spotting anything.

A payment-change process, step by step

Put this on one page, share it with everyone who can pay a bill, and tell your suppliers you work this way.

Freeze. When any request changes payee details (new account number, new payee name, new payment method), don't change anything yet and don't reply to the email.
Call to verify. Phone the supplier on a number you already hold from before the request, or from their official website. Own Your Online advises using publicly listed contact details or the number you usually call, never the details on the email or invoice. Ask the person to confirm the old and new account numbers.
Second person approves. A different staff member checks the call notes and approves the change in your accounting or banking system. One person should never both receive and approve a bank detail change.
Record it. Note who called whom, on which number, when, and who approved. A simple shared log is enough.
Test with a small amount if the supplier agrees, then confirm receipt before sending the full payment.
Watch the first payment. Ask the supplier to confirm when the first payment to the new account lands.
Tell the supplier if it was fake. If the request turns out to be fraudulent, call them; their mailbox may have been compromised and other customers may be targeted.

If your banking app shows a payee-name mismatch warning when you add or edit an account, stop and verify before paying.

Reduce the chance it's your mailbox

Turn on two-factor authentication for every email account, starting with whoever sends invoices. Most compromises start with a stolen password.
Use unique passwords stored in a password manager, so a password leaked elsewhere doesn't open your email.
Check mailbox rules. Attackers often add hidden forwarding or rules that move replies out of sight. Review these in your email admin settings now and then, and after any suspected phishing click.
Set up email authentication (SPF, DKIM and DMARC) on your domain so it's harder for others to send mail that looks like it comes from you. Your email provider or web person can do this.
Make your invoices predictable. Tell customers once, in writing and on your website, that your bank details won't change by email and that they should call you if they ever receive such a request. Own Your Online also points to eInvoicing as a way to make invoice fraud harder.

If it has already happened

Call your bank immediately. Own Your Online notes the bank may be able to recover the money; the sooner they can contact the receiving bank, the better the odds.
Report it to New Zealand's National Cyber Security Centre, which Own Your Online links to, so it can advise you and alert the business being impersonated.
Change passwords on any email account that might be involved, sign out all sessions, check forwarding rules, and turn on two-factor sign-in.
Tell the real supplier, and if the compromise was on your side, warn your customers that any change of bank details from you should be ignored.
Keep the evidence: the emails with full headers, attachments and payment records.

FAQ

Can't we just check that the email looks right?

No. When a real mailbox is compromised, the email is genuine in every visible way: correct address, real thread, real signature. Only an independent phone call catches that.

Is a text message confirmation enough?

Only if you send it to a number you already had, not one supplied in the email. A call is better because you hear a person you can recognise.

What if the supplier gets annoyed by the calls?

Most suppliers appreciate it. Explain it's your standard process for every bank detail change. A two-minute call costs far less than a redirected payment.

Should we stop paying by bank transfer?

Not necessarily. The risk is in the change of details, not the payment method. Keep transfers, and make the change process strict.

If you'd like your invoicing emails, domain authentication and payment-change approvals set up properly, ask us to look at how your invoices go out.