Payment Redirection Fraud: How a Genuine Invoice Becomes a Stolen Payment

An email arrives from your supplier's usual contact, in the same thread you have used for months. It quotes the correct invoice number, the right container number and the agreed amount. It says the company's bank account has changed after an audit and asks you to use the new details for this payment, today if possible, because the office closes for a holiday tomorrow. Everything in the message is accurate except the one line that matters.

Short answer. Payment redirection fraud is a fraud in which criminals change the payee details on a genuine transaction, usually by compromising or imitating an email account. It is a form of what law enforcement calls business email compromise (BEC). Accurate transaction details prove nothing, because the criminal may be reading the real correspondence. The control that addresses this directly is procedural: any new or changed payment instruction is confirmed through contact details you held before the request, and payment waits until it is. Supporting controls reduce the chance of a mistake getting through. If money has already gone, contact your bank immediately and report the fraud. No control guarantees prevention, and recovery cannot be promised.

How the fraud gets in

The FBI describes three common techniques: email addresses that differ slightly from a legitimate one, spear-phishing messages designed to obtain access to company systems, and malware that gives criminals access to genuine email discussions about billing and invoices. FBI, business email compromise

In trade, that produces two broad entry points:

• The supplier's mailbox: the supplier's email account is compromised, and the message comes from the genuine address, inside the genuine thread.
• Your mailbox, or a look-alike: your own account is compromised, or a look-alike address joins the conversation in place of the real one.

Commodity traders are among the targets. INTERPOL reported in August 2024 that a Singapore-based commodity firm transferred about US$42 million after receiving an email, from an address spelled slightly differently from its supplier's, asking for a pending payment to go to a new bank account. INTERPOL, 6 August 2024 INTERPOL's African cyberthreat reporting noted a significant rise in BEC-related incidents in 2025, and in 2026 described BEC schemes using artificial intelligence to generate highly convincing correspondence. INTERPOL, 23 June 2025; INTERPOL, 3 August 2026

Why correct details are consistent with fraud

Staff are often trained to look for errors: a wrong invoice number, an odd amount, poor grammar. Redirection fraud defeats that training when the fraudster has the real documents. A compromised thread can supply the invoice, the container number, the names and the tone.

Technical checks help but do not close the gap. The US Cybersecurity and Infrastructure Security Agency (CISA) recommends implementing the email-authentication standards SPF, DKIM and DMARC (Sender Policy Framework, DomainKeys Identified Mail, and Domain-based Message Authentication, Reporting and Conformance) together, to restrict email sent on behalf of a domain by people who do not own it. CISA, CM0055 That protects your own domain. In our assessment it does not, by itself, stop a look-alike domain or a message sent from a genuinely compromised supplier account; a check outside the email channel is needed for those.

The scale, with its limits

• The FBI's Internet Crime Complaint Center (IC3) recorded 24,768 BEC complaints in 2025, with losses of about US$3.05 billion reported in them. These are complaints made to IC3, not a total for all BEC. FBI IC3, 2025 Internet Crime Report
• UK Finance reported £41.3 million of invoice and mandate scam losses across 2,305 cases in 2025, from its members' data, covering both personal and business accounts. UK Finance, Annual Fraud Report 2026

Neither figure tells you the odds for your business. Both show that the pattern is common enough to deserve a written control.

Independent verification of any change

Treat every new payment instruction, and every change to an existing one, as unverified until it is confirmed outside the channel that delivered it. The FBI advises verifying any change in account number or payment procedures with the person making the request, in person if possible or by phone, and being especially wary of pressure to act quickly. The UK's Report Fraud service advises contacting the supplier directly using official and verifiable contact details. FBI; Report Fraud, mandate fraud

A usable procedure:

1. Hold. No payment goes to new details until verification is complete, whatever the deadline in the message.
2. Call a number you already held. Use the number in the contract, your supplier master file or an earlier verified record, never one in the request, its signature block or an attached letter.
3. Speak to a known person in the supplier's finance function, where possible someone other than the sender.
4. Ask them to state the details. Ask for the new account number and beneficiary name, rather than reading them out for a yes.
5. Record the check: who called, whom they spoke to, the number used, what was confirmed and when.
6. Second approval. A different person approves the change in your supplier master data before any payment.

For large sums, Report Fraud also suggests considering a small test payment first and confirming that the intended recipient received it. A test shows that an account can receive money; it does not prove who controls it, so it supplements the call rather than replacing it.

Know the limit of the callback. If the supplier's phone number in your records was itself changed through a compromised email, the call reaches the fraudster. That is why changes to contact details need the same controls as changes to bank details.

Supporting controls

• Dual approval for payments above a threshold you set, and for every first payment to a new account.
• A master-data change process covering bank details, contact numbers and email addresses, with independent verification and a second approver.
• A first-payment rule: before any money moves to a new supplier, confirm that the company exists and that the receiving account belongs to it or to a documented, explained payee, using contact details you obtained independently.
• Account security: phishing-resistant multi-factor authentication, and DMARC set to "reject", as recommended in joint guidance from CISA, the NSA, the FBI and MS-ISAC. CISA, NSA, FBI and MS-ISAC, phishing guidance
• Payee-name checks where your payment system offers them. The UK's Confirmation of Payee is a name-checking service for UK domestic payments, and the EU's Verification of Payee covers euro SEPA credit transfers, including instant ones; the European Payments Council says its check cannot be relied upon to identify a person or entity. Pay.UK; EPC, Verification of Payee Neither covers most international trade payments.
• Awareness of red flags. Europol lists signs such as pressure and urgency, requests for absolute confidentiality, requests that contradict internal procedures and requests for international payments to banks outside Europe. Europol, CEO/BEC fraud

These controls work together, and no effectiveness ranking is implied. Independently verifying the instruction through previously established contact details directly addresses the scenario in which the supplier's email account has been compromised, because the check does not pass through that account. The other controls address different routes by which a false instruction can succeed.

Signals that should trigger the procedure

None of these proves fraud. Each is a reason to verify before paying.

Signal	Why it matters	Action
Any change to bank details, however routine the explanation	The payee field is what the fraud needs to change	Hold and verify independently
A new account in a different country or in a different company name	The payee may have no right to the money	Ask why, in writing, and verify by phone before any payment
Urgency, a holiday deadline or a request for confidentiality	Pressure shortens checks	Treat as a reason to slow down
A sender address or domain that differs slightly	A look-alike address may have joined the thread	Compare against your records; verify by phone
Messages you did not send, emails moved or deleted, or unexpected password resets	Australia's cyber security agency lists these as signs that an email account may be compromised	Tell IT; check the account. ACSC, BEC

When you are the one being paid

Suppliers are targets too: someone who controls a seller's mailbox can redirect that seller's customers. If you invoice international buyers:

• Tell customers in advance, in the contract or onboarding pack, that your bank details will not change by email alone and how they can verify any change.
• Announce genuine changes through more than one channel and invite customers to call a number they already hold.
• Protect your own accounts with multi-factor authentication and email authentication on your domain.
• Act on warnings. If a customer asks about a change you did not make, assume your systems may be compromised and involve your IT provider and bank at once.

The first hour after a wrong payment

Speed matters. The FBI's 2025 annual report advises contacting your financial institution immediately and requesting a recall of the funds. FBI IC3, 2025 Internet Crime Report

1. Call your bank using its official website or phone number, not contact details from any email, as the UK National Cyber Security Centre (NCSC) advises. NCSC, business payment fraud Ask the bank to recall the payment and to contact the receiving bank. FBI
2. Report it. In the United States, to IC3. In England, Wales and Northern Ireland, to Report Fraud, which replaced Action Fraud in December 2025. City of London Police In the UAE, the government portal lists the Ministry of Interior eCrimes platform, Dubai Police's eCrime website and Abu Dhabi Police's Aman service, as well as reporting at a police station. UAE Government portal Elsewhere, use the national police or cybercrime channel.
3. Preserve evidence. Do not delete the messages or records. IC3 advises keeping original documents, such as wire receipts, in a safe place in case investigators ask for them. IC3, FAQ
4. Tell your IT department or provider as soon as you can, as the NCSC advises, so the account can be secured and examined. NCSC, business payment fraud
5. Inform the real supplier through a verified route. Its systems may be compromised too.

What to expect about recovery

Be realistic. In 2025, the FBI's Financial Fraud Kill Chain, which works with banks to help freeze funds, reported about US679millionfrozenoutofaboutUS1.16 billion in attempted theft across the incidents it handled; frozen money is not the same as money returned to victims. FBI IC3, 2025 Internet Crime Report UK Finance members returned £20.0 million of the £41.3 million invoice and mandate scam losses reported for 2025. UK Finance, Annual Fraud Report 2026

In the UK, the reimbursement requirement for authorised push payment (APP) scams, in effect since 7 October 2024, applies to Faster Payments and CHAPS payments sent and received by UK payment service providers, covers only payments made by individuals, microenterprises and charities, sets a maximum of £85,000 and does not apply to international payments. PSR, PS25/5 An international payment to an overseas supplier falls outside it, as does a payment by a business larger than a microenterprise.

Interbank tools such as Swift's stop and recall service let banks stop payments in flight, but they do not guarantee that money comes back. Swift gpi Assume that money sent abroad may not be recovered.

Worked example: every detail correct

Hypothetical teaching example. The milk powder importer, its supplier and the messages are invented. This is not a Maqboola transaction.

On the eve of a public holiday, the importer's accounts clerk receives the email described at the start. The sender address is the supplier's genuine one. The invoice number, container number and amount match the importer's records.

The clerk's written procedure requires a hold and a callback. The supplier's number in the master file goes to its finance manager, who says no change has been made; the supplier's email account had been compromised. The payment goes to the original, verified account after the holiday.

Every detail was correct because the fraudster had the real correspondence. The accuracy that looked reassuring was part of the fraud. The control that worked did not depend on spotting an error.

Write the rule down

A control that lives in one person's head fails on the day that person is away. Put a one-page rule in writing, and make it apply to everyone, including the owner:

• No payment to new or changed details without independent verification recorded on file.
• Verification uses contact details held before the request.
• Changes to supplier bank or contact details need a second approver.
• Urgency or confidentiality in a payment request triggers verification; it never shortens it.
• Suspected fraud is reported to the bank at once, whatever the hour.

Related reading

• How much advance payment is reasonable: structuring a first order so less money is exposed before the goods move.
• Choosing between a documentary collection and a letter of credit: payment methods that route money through banks against documents.

General information. This article explains common fraud patterns and published guidance for general educational purposes; it is not legal, banking or cyber-security advice. Reporting channels, recall options and reimbursement rules differ by country, bank and payment system, so confirm what applies with your bank and the relevant police or cybercrime authority.