Could your business spot a fraudulent invoice before it was paid?

September 3, 2026

Fraudulent invoices often succeed because they look routine. A stronger defence is a repeatable payment process that treats changed bank details, unusual requests and supplier record changes as triggers for independent verification before money leaves the business.

Key takeaways:

  • A familiar logo, ABN or email thread does not prove an invoice is genuine because payment redirection scams can imitate or compromise real supplier communications
  • Changed bank details should be verified through contact information sourced independently from the email or invoice requesting the change
  • Separating supplier setup, supplier-detail changes and payment approval creates more opportunities for an unusual transaction to be challenged
  • Individual user accounts, appropriate permissions and multifactor authentication strengthen accounting system security but still need to sit alongside payment controls
  • If money has already been transferred after a suspected scam, contact the bank or financial institution immediately and then follow the reporting and supplier-verification steps

An invoice arrives from a supplier you know. The logo is right, the amount looks reasonable and the email appears to have come from the usual contact.

There is just one difference. The bank account details have changed.

Would someone in your business notice before the invoice was paid?

Fake invoices and payment redirection scams can be difficult to identify because the invoice itself may look completely legitimate. Criminals can impersonate a supplier, use an email address that closely resembles the real one or gain access to a genuine email account. In some cases, they can insert themselves into an existing email conversation.

The risk is significant for Australian businesses. In the 2024 to 2025 financial year, business email compromise involving financial loss accounted for 15 per cent of the top self reported cybercrime threats affecting Australian businesses. The average reported cost of cybercrime for a small business was $56,571.

Having the right checks around invoices, supplier information and payments can help reduce that risk.

Your First Class Accounts bookkeeper already works with the financial records and processes behind many of these transactions. They can help you review how invoices and supplier information are handled and identify areas where stronger financial controls may be appropriate.

Why a fraudulent invoice can be difficult to spot

A common form of invoice fraud is payment redirection.

A criminal may gain access to a supplier’s email account or create an email address that closely resembles it. They then send an invoice or payment request containing different bank details.

The business receiving the invoice believes it is paying a genuine supplier. By the time anyone discovers the supplier has not received the payment, the money may already have been transferred elsewhere.

Scamwatch warns that fake invoices can contain genuine business logos and ABNs and may even appear within an existing email conversation.

This is why relying on an invoice looking familiar is not enough.

It is also why invoice checking should form part of an established financial process. Speak with your First Class Accounts bookkeeper about how supplier invoices currently move through your business and whether there are points in that process that deserve an additional check.

What is the safest way to verify changed supplier bank details?
Do not verify the change by replying to the same email or using the phone number contained in it. Contact the supplier through a number or channel your business already trusts, or one sourced independently, and confirm the new bank details before the supplier record or payment is changed.

Changed bank details should trigger another check

A supplier advising that their bank account details have changed deserves particular attention.

Scamwatch recommends checking payment details directly with the business using independently sourced contact information rather than relying on the contact details contained in the email requesting the change.

The important part is making sure your business has an agreed process for what happens when supplier payment information changes.

Who updates the details?

Who confirms that the request is genuine?

Is there a record showing that the change was checked?

Who can then approve the payment?

Your First Class Accounts bookkeeper can help you review how supplier details are currently maintained within your bookkeeping system and discuss an appropriate process for recording and verifying changes before payments are processed.

What should be recorded when supplier bank details are changed?
Keep a simple audit trail showing who requested the change, how the supplier’s identity and new details were verified, when the check took place and who approved the update. That record makes the control repeatable and gives the next person in the payment process something concrete to review.

Who can create, change and approve payments?

The way financial responsibilities are allocated within a business can also affect the level of protection around payments.

If the same person can create a new supplier, alter supplier information, prepare a payment and approve that payment without another person reviewing the transaction, there may be fewer opportunities for an unusual change to be identified.

The appropriate approval process will depend on the size and structure of the business. Some businesses may require additional approval for larger transactions, new suppliers or payments where bank information has recently changed.

This does not need to mean adding unnecessary administration to every invoice. The objective is to have controls that reflect how your business operates and the level of risk associated with different transactions.

Your First Class Accounts bookkeeper understands how financial information moves through your business. Ask them to review your current bookkeeping and payment processes with you and discuss whether responsibilities and approval points are appropriately structured.

Why separate supplier maintenance from payment approval?
Separation creates a second opportunity to notice something unusual. If one person can create a supplier, change bank details and approve the payment, a fraudulent change can move through the process without challenge. A second reviewer does not guarantee safety, but it reduces reliance on one person spotting every warning sign.

Review access to your accounting software

Your accounting software contains important financial information about your customers, suppliers and transactions.

Over time, it is easy for user access to become outdated. Employees change roles, people leave the business and external advisers may no longer require the same level of access.

Permissions should reflect what each person actually needs to do.

Individual user accounts are also preferable to shared logins because they make it easier to control permissions and understand which user completed a particular action.

Multifactor authentication provides another layer of protection for important business accounts. At First Class Accounts, we always recommend multifactor authentication as an important measure for protecting business systems and accounts.

You do not need to work through your accounting software permissions alone. Your First Class Accounts bookkeeper can help you review who has access to your bookkeeping system, whether those permissions remain appropriate and which accounting software security features are available to your business.

Does multifactor authentication stop fraudulent invoice scams?
Multifactor authentication makes it harder for criminals to access an account using only a stolen password, but it cannot stop a staff member from paying a convincing fraudulent invoice. Account security and payment verification solve different parts of the risk, so both are needed.

Make suspicious transactions easier to question

People involved in processing invoices and payments need to know what should receive additional attention.That may include:

  1. A supplier advising that their bank account details have changed.
  2. An unexpected invoice from a familiar supplier.
  3. A payment request that differs from the supplier’s usual arrangements.
  4. An email address that looks slightly different from the one normally used.
  5. A request to make an unusually urgent payment.
  6. An unexpected request from an owner or manager to transfer funds.
  7. An invoice that does not match a purchase, order or service the business was expecting.

Scamwatch’s current guidance for small businesses identifies invoices and business email compromise among the common scams businesses should watch for.

The important part is having a process that gives employees permission to stop and check before proceeding.

If several people are involved in accounts payable, your First Class Accounts bookkeeper can help you establish a consistent bookkeeping process so everyone understands what information should be checked and when something should be referred for further verification.

Keep supplier records accurate

Accurate supplier records make it easier to identify information that does not match what your business already holds.

Duplicate suppliers, outdated contact details or inconsistent information can make that more difficult.

Your bookkeeping system should provide a reliable financial record of the businesses you deal with and the transactions associated with them.

This is an area your First Class Accounts bookkeeper can manage with you. Regularly maintaining supplier information, reviewing duplicate records and keeping bookkeeping data current can make it easier to identify unusual changes when they occur.

Scamwatch also recommends businesses consider electronic invoicing as one way to reduce exposure to fake invoice scams. Electronic invoicing allows invoices to move directly between compatible accounting systems rather than being sent as attachments through email.

If you are interested in electronic invoicing, speak with your First Class Accounts bookkeeper about whether your accounting software supports it and whether it is suitable for your business.

Can eInvoicing eliminate the risk of fake invoices?
No. eInvoicing can reduce exposure to altered invoice attachments because invoices move directly between compatible systems, but it does not replace supplier controls, user access reviews or payment approvals. It should be treated as one layer in the process rather than the only safeguard.

What if you think a fraudulent invoice has already been paid?

If you believe money has been transferred as the result of a fraudulent invoice, acting quickly is important.

Contact your bank or financial institution immediately and explain what has happened.

The genuine supplier should also be contacted using independently verified contact details, particularly if there is a possibility that their email account or your own business email has been compromised.

The incident can also be reported through Scamwatch and ReportCyber.

What should happen first after a suspected fraudulent payment?
Contact the bank or financial institution immediately. Acting quickly gives the bank the best opportunity to respond to the transfer. Then contact the genuine supplier using independently verified details, secure any compromised accounts and report the incident through the relevant Scamwatch and ReportCyber channels.

Would your current payment process catch it?

A fraudulent invoice may not look fraudulent.

It could carry the right logo, use familiar language and arrive at exactly the time you were expecting to receive it.

That means protecting your business also depends on what happens before the payment is approved.

Who can change supplier details? How are those changes checked? Who reviews invoices? Who approves payments? Who has access to your accounting software?

These are important financial processes, and they are worth reviewing before a problem occurs.

Speak with your local First Class Accounts bookkeeper about your current bookkeeping, supplier and payment processes. They can help you identify where additional financial controls may be appropriate and ensure the systems supporting your day to day bookkeeping are working the way your business needs them to.

Sources

Frequently Asked Questions

1. What is a payment redirection scam?
A payment redirection scam occurs when a criminal impersonates or compromises a supplier and replaces the genuine payment details with an account they control. The invoice may otherwise look normal, which is why changed bank details and unexpected payment instructions need independent verification.
2. How should a business verify new supplier bank details?
Use contact information that is already trusted or sourced independently from the request. Speak with an authorised supplier contact and confirm the account details before updating the supplier record or approving payment. Do not rely on replying to the email that asked for the change.
3. Should the same person be able to create a supplier and approve payment?
Where practical, separating those responsibilities gives the business another review point before money leaves the account. The exact approval structure depends on the size of the business, but higher-risk changes such as new suppliers, changed bank details and large payments are sensible places to add a second check.
4. Does multifactor authentication protect against business email compromise?
It reduces the risk of an account being accessed with a stolen password and is an important security control. It does not remove business email compromise or invoice fraud risk entirely, because criminals can also impersonate addresses or manipulate people into authorising a payment.
5. Can eInvoicing help reduce fake invoice scams?
Yes. Scamwatch recommends businesses consider eInvoicing because invoices can move directly between compatible software instead of relying on emailed attachments. It can reduce one avenue for invoice manipulation, but normal supplier verification and approval controls are still required.
6. What should a business do if it has already paid a fraudulent invoice?
Contact the bank or financial institution immediately and explain what happened. Contact the genuine supplier using independently verified details, review whether email or accounting accounts may be compromised, and report the incident through Scamwatch and ReportCyber. Speed matters once a transfer has been made.

FCA Blog