Invoice fraud, also known as business email compromise (BEC) or impersonation fraud, is becoming increasingly common and sophisticated. In this form of fraud, criminals intercept or impersonate communications between a company and its supplier, modify legitimate invoices with fraudulent banking details, and reroute payments to their own accounts. This can lead to significant financial losses, strained business relationships, and costly recovery efforts.
This article outlines the modus operandi of invoice fraud, best practices for mitigation, and the role of insurance and supplier contracts in protecting businesses from this pervasive threat.
The Modus Operandi of Invoice Fraud
Invoice fraud can happen in several ways, but the primary method is through intercepting or impersonating email communications. Here’s a typical scenario:
Initial Targeting: Criminals identify a company and one of its suppliers, exploiting a weakness in either party’s security. They may hack into the supplier's system or impersonate the company needing to pay.
Invoice Request and Interception: Posing as the paying customer, the fraudster requests an invoice from the supplier using a convincing but fraudulent email address.
Modification and Redirection: The fraudsters alter the invoice details, changing the legitimate bank account information to their own account.
Delivery to the Customer: The fraudster sends the tampered invoice to the real customer email, convincing them to pay the invoice to the new account.
This type of fraud has spread globally, impacting organizations of every size. In many cases, large businesses receive up to 50 to 100 daily attempts at such impersonation.
Mitigating Invoice Fraud | Essential Practices
Invoice fraud often hinges on social engineering, and mitigation begins with a few essential practices to protect businesses from falling victim. Here’s how companies can implement robust processes to safeguard against invoice fraud:
Authenticate Supplier Information with Token Payments
Before paying a new supplier or responding to a change in banking details, send a token payment—a small, nominal amount—to the provided bank account. After the payment, confirm receipt through both written and verbal communication with a trusted representative of the supplier. This simple check can expose fraudulent account details before larger payments are made.
Verify Changes in Banking Details Carefully
Treat any request to change banking details as highly suspicious. Implement a policy requiring multiple levels of authentication and verbal verification. Also, alert suppliers that once a bank account is confirmed, it will never change without rigorous, multi-step verification.
Partner with Your Bank for Quick Response
In the event that fraud is discovered, work closely with your bank to attempt a recall or request a bounce on the transaction. Speed is critical here, as the sooner the bank is alerted, the better the chance of recovering the funds.
Train Payment Clerks on Impersonation and Fraud Detection
Payment clerks are often the first line of defense, but they need to be equipped with the knowledge to recognize fraud attempts. Training should cover phishing awareness, email verification, and common tactics used by fraudsters. Mistakes in handling payments should be addressed with corrective measures and, if necessary, managed through a performance improvement process to maintain accountability.
Secure Contracts with Suppliers
Establish clear expectations with suppliers through well-defined contracts. Include clauses that mandate:
Prompt notification of security breaches or suspicious activity affecting either party.
A dispute resolution process to resolve incidents quickly and without extensive legal costs.
A commitment from the supplier to ensure their banking details are stable, adding an additional layer of accountability.
One common tactic for email fraud involves spoofing the display name in an email, making it appear as if it's coming from a trusted source while using an unrelated email address—often from popular domains like Gmail or Yahoo. This technique relies on the fact that most email clients display only the sender's name prominently, hiding the actual email address unless closely examined. For instance, an attacker might use a display name like "Accounts Payable" or "CEO's Office" and associate it with an email like "randomaddress@gmail.com."
How This Technique Works
Display Name Modification: Attackers set a familiar or trusted display name, causing the email to appear legitimate at first glance.
Email Address Inconsistency: Although the display name is recognizable, the email address domain (e.g., @gmail.com) often does not match the expected domain (e.g., @yourcompany.com).
Social Engineering: Attackers exploit trust, hoping recipients will act quickly without scrutinizing the sender's email address.
How to Detect and Prevent Display Name Spoofing
Train Users to Check Full Email Addresses: Educate staff to look beyond display names and verify the sender’s actual email address.
Implement Email Authentication Protocols: Enforce protocols like SPF, DKIM, and DMARC to help identify and filter suspicious emails.
Flag External Emails: Mark emails from external domains to alert users that the sender is not internal, encouraging them to be cautious.
Being vigilant with sender email verification can help prevent falling victim to these impersonation attempts.
Preventing Busin**ess Email Compromise (B**EC) & Invoice Fraud | Bank Account Verification Steps
Business Email Compromise (BEC) and invoice fraud are common tactics used to redirect payments to fraudulent bank accounts, resulting in significant financial losses. A simple yet effective method to prevent these types of attacks involves requiring suppliers to provide a bank letter confirming their account details. Here’s how the process works:
Requ**est a Bank Verification Letter**: When onboarding new suppliers or making changes to existing bank details, insist they provide a formal bank letter. This document should include the supplier’s account number, bank name, and official verification from a bank representative.
Directly Verify with the Bank: Once the bank letter is received, call the bank directly using a publicly listed contact number to confirm the authenticity of the bank letter and the supplier’s account details. This step ensures that the letter and account details are legitimate, safeguarding against intercepted or modified emails and fraudulently altered documents.
Establish Protocols for Account Changes: Implement internal policies requiring verification of all supplier account changes through this method. By building these checks into payment procedures, businesses can minimize the risk of BEC and invoice fraud.
By adding this extra layer of verification, organizations can reduce the chances of being victims of fraud, safeguarding both themselves and their suppliers.
The Role of Insurance in Invoice Fraud Mitigation
Invoice fraud insurance can provide an important safety net for businesses facing significant risks. However, insurers will often require evidence of due diligence—which includes following strict internal processes for payment verification and fraud prevention. This requirement makes invoice fraud insurance not only a useful tool but also an incentive for companies to enforce best practices.
When due diligence is adequately demonstrated, insurance can cover the loss resulting from fraudulent payments. Having insurance, however, should not replace best practices but complement them. An insurer is unlikely to provide compensation if a company fails to follow its stated fraud prevention policies.
Additional Best Practices for Comprehensive Mitigation
In addition to the measures above, businesses can adopt a layered approach to security, which combines technology, processes, and employee vigilance. Here are further strategies for creating a resilient anti-fraud framework:
Multi-Factor Authentication (MFA): Implement MFA on all systems that manage payments, ensuring access is tightly controlled.
Email Security: Use email security tools to detect spoofing attempts and filter suspicious emails.
Secure Supplier Portals: Require suppliers to use secure portals or digital signatures for sensitive communications instead of relying solely on email.
Regular Audits: Regularly audit your financial transactions to identify any suspicious patterns early on.
Wrapping Up
In the world of cybersecurity, partial mitigation is far better than none. Each layer of security reduces the likelihood of successful fraud and raises the difficulty for attackers, prompting them to look elsewhere. For businesses, this means that even if no system is perfect, taking preventative action can make the difference between security and compromise.
The growth of invoice fraud underscores the need for vigilance, robust processes, and a proactive approach to business payments security. From establishing clear supplier agreements to training employees and utilizing insurance effectively, businesses can better protect themselves from this increasingly pervasive threat.
