Supplier invoice fraud is one of those cyber risks that does not need malware, a server outage or an obviously suspicious attachment. A convincing email, a familiar supplier name and a request to pay an invoice into a new bank account can be enough.
For a small business, the impact can be immediate: money is sent to a criminal-controlled account, the genuine supplier is still unpaid, and recovery becomes harder with every hour that passes. The strongest defence is not a single security product. It is a combination of secure email, sensible payment controls and staff knowing exactly what to verify.
What does supplier invoice fraud look like?
The basic approach is simple. An attacker impersonates a supplier, director or member of the finance team and asks for a payment to be made or bank details to be changed. The message may arrive from a lookalike domain, a spoofed address or, more seriously, a genuine mailbox that has been compromised.
That last scenario is particularly convincing. If criminals gain access to a real Microsoft 365 mailbox, they may read existing conversations and wait for the right moment to intervene. A fraudulent bank-detail change inserted into a genuine invoice discussion can be much harder to spot than a generic phishing email.
Make bank-detail changes a controlled process
The most effective control is also one of the simplest: never approve a supplier bank-detail change from email alone.
When a supplier asks to change payment details, verify the request using a second channel. Call a known contact using a telephone number already held in your records, not a number supplied in the change request. For larger payments, consider requiring approval from a second member of staff before the payment is released.
This process should apply even when the email looks completely genuine. The point is not to decide whether an email appears suspicious; it is to make email insufficient on its own to redirect money.
Protect the Microsoft 365 accounts criminals want
Finance staff, directors and anyone who can authorise payments are high-value targets. Their accounts should have multi-factor authentication enabled, with legacy authentication disabled and sign-in activity monitored for unusual behaviour.
Businesses using Microsoft 365 should also review mailbox forwarding rules and suspicious inbox rules. Attackers sometimes create rules to hide replies, move messages or forward copies externally while they monitor a conversation.
Strong email filtering helps identify impersonation, malicious links and unusual sender behaviour, but it should support the payment process rather than replace it. No email security system can guarantee that every convincing social-engineering attempt will be stopped.
Give staff a clear escalation route
Employees need to know what to do when something feels wrong. A finance administrator who receives an urgent request from a director should be able to verify it without worrying that they are delaying the business.
Useful warning signs include unexpected urgency, secrecy, changed bank details, unusual payment timing, a request to bypass normal approval, or subtle changes to a sender’s domain name. Staff should also be wary when the writing style or request does not fit the normal relationship, even if the display name is familiar.
A short, documented process is better than a long security policy nobody remembers. For example: stop the payment, verify independently, report the message, and escalate internally if there is any doubt.
If money has already been sent, act quickly
If a fraudulent payment has been made, contact the bank immediately and explain that the transfer was made as a result of fraud. Speed matters because there may be an opportunity to freeze or recover funds before they are moved onwards.
At the same time, preserve the relevant emails and audit information. If a Microsoft 365 account may have been compromised, reset credentials, revoke active sessions, check authentication methods, review forwarding and inbox rules, and investigate sign-in activity. Do not simply change the password and assume the incident is over.
The incident should also be reported through the appropriate UK fraud-reporting route, and businesses should consider whether insurers, customers, suppliers or regulators need to be informed depending on what data or accounts were affected.
A five-minute check that can prevent a major loss
Small businesses do not need an enterprise security department to make invoice fraud significantly harder. Start by checking three things: bank-detail changes are independently verified, payment-capable Microsoft 365 accounts are properly protected, and staff know how to stop and escalate an unusual request.
Those controls cost very little compared with the disruption of trying to recover a fraudulent transfer.
ML Services helps businesses across Worthing and Sussex strengthen Microsoft 365, email security and day-to-day IT processes. If you want an independent review of your current protections, contact ML Services for a practical security check.