Real Invoice vs Business Invoice Fraud (BEC)
How to spot a fraudulent invoice or bank-detail change request versus a legitimate supplier invoice.
Last reviewed: 1 June 2026
Nearly every invoice that arrives in a finance inbox is genuine, and paying them promptly is simply the job. That routine is precisely what payment diversion fraud exploits. The fraudulent invoice usually looks like the ones you already pay, sometimes because it is a real invoice that has been intercepted and altered, and sometimes because the supplier's own mailbox has been compromised. It arrives in a familiar thread, on the expected day, from a name you know. What changes is the destination account, presented as a banking migration or a new facility, with just enough urgency to discourage a phone call. The distinction that matters most is not the wording of the email but the route you use to check it. Bank details confirmed only by email are not confirmed at all, however well the email reads.
Side-by-side comparison
| Genuine supplier invoice | Fraudulent invoice / BEC payment diversion | |
|---|---|---|
| Bank details | Account number stable over time; any change confirmed by a phone call to a known number | New bank details supplied in the email itself, often explained as 'banking change' or 'new account' |
| Email origin | Sent from a domain you have on file; no extra characters or hyphens in the address | Sent from a look-alike domain (e.g. supplier-invoices.com instead of supplier.com) or a spoofed address |
| Urgency | Normal payment terms; no unusual pressure to pay today | Marked 'urgent', 'overdue', or warns of legal action if not paid within hours |
| Verification route | Contact details on the invoice match those in your records and on the supplier website | Contact number given is a new mobile; replying to the email loops back to the fraudster |
| Invoice format | Consistent formatting, logo, and numbering sequence with previous invoices | Slight differences in logo resolution, font, or invoice numbering compared to genuine examples |
| Request scope | Invoices a specific agreed product or service | Vague line items, duplicate invoice numbers, or amounts that do not match any purchase order |
Common red flags
- Bank details changed in the same email as an invoice
- Supplier contact number on the invoice is a new mobile you cannot verify
- Email domain differs slightly from the known supplier address
- Unusual pressure to pay before end of day
- Invoice references no specific purchase order
Verification steps
- Call your supplier contact on the number you already have — not the one in the email — to confirm any bank change
- Compare the sender email domain character by character with your records
- Cross-reference the invoice against your purchase order system
- Implement a two-person sign-off rule for any change to stored supplier bank details
What not to do
- Do not action a bank-detail change based solely on an email, however convincing
- Do not call the phone number provided in a suspicious invoice to verify it
- Do not let urgency pressure override your verification procedure
A safe response
Hold the payment. Nothing is lost by a day's delay and a genuine supplier will understand it. Call your usual contact on the number already held in your own records, not one printed on the invoice or in the signature, and ask them to confirm the change verbally. Do not verify by replying to the thread, because if the mailbox is compromised the fraudster answers. If the payment has already gone, tell your bank immediately and ask them to attempt a recall, report it to your national fraud reporting service, and warn the supplier, whose systems may also be affected. Afterwards, add two-person sign-off for any stored bank detail change.
Frequently asked questions
We have already paid the fraudulent account. What happens now?
Tell your bank immediately and ask them to contact the receiving bank about a recall, because funds are sometimes still traceable in the first hours. Report it to your national fraud reporting service and keep the reference number. Inform the genuine supplier, since their invoice is still unpaid and their mailbox may be compromised. Preserve the emails and their headers rather than deleting anything. Whether money is returned is decided by the banks and investigators, so give them everything quickly.
Can my supplier's email account itself be hacked?
Yes — in some BEC cases the real supplier's inbox is compromised, making the email look perfectly genuine. This is why phone verification to a pre-existing number is essential, not just email-header checking.
Is BEC fraud covered by insurance?
Coverage varies by policy. Some cyber-insurance and crime policies cover BEC losses; others exclude them. Check your policy and speak to your broker if you have been targeted.