How can I avoid invoice fraud in international payments?

Question

Accepted Answer

Use a documented payment-verification process, independently confirm supplier bank details, and require additional approval for unusual payments or changes to payment instructions. Invoice fraud often involves criminals impersonating a genuine supplier or compromising a business email account to redirect a legitimate payment. Always verify changes through a separate, trusted communication channel before transferring funds. Verify Every New Supplier and Bank Account Before making the first payment, confirm the supplier's legal identity, invoice details, beneficiary name, account number or IBAN, bank name, and required SWIFT/BIC information. Check that the beneficiary is consistent with the contracting party or that any third-party payment arrangement has been independently verified and properly documented. Obtain banking details through a trusted process rather than relying solely on an email attachment or an informal message. Verify Changes Through a Separate Channel Treat a request to change bank details as a potential fraud risk, even when it appears to come from a familiar supplier's email address. Call a known contact using a number already on file or independently verified, and confirm the change verbally before acting. Do not use the phone number provided in the suspicious message as the only verification method. Be especially cautious when the request is unexpected, urgent, confidential, or accompanied by altered invoice details. Check Invoices and Strengthen Payment Controls Compare the invoice with the purchase order, signed contract, goods or services received, agreed currency, amount, due date, and beneficiary details. Establish separation of duties so that one person cannot independently create a supplier, change its banking details, approve an invoice, and release the payment. Use dual approval for significant transfers and unusual exceptions, and maintain a clear audit trail of every change and authorization. Protect Email and Financial Systems Use multi-factor authentication, strong unique passwords, appropriate account permissions, and staff training on phishing and business email compromise. Pay attention to lookalike domains, altered sender addresses, unexpected attachments, and messages requesting secrecy or rapid action. Establish a documented procedure for reporting suspicious invoices and bank-detail changes without creating pressure to bypass normal controls. Respond Quickly if Fraud Is Suspected If a payment may have been redirected to a criminal account, contact your bank immediately and request urgent tracing or recall action. Notify your finance and security teams, preserve the original emails and invoices, and report the incident to the appropriate law-enforcement authority. Recovery is not guaranteed, so speed matters. The FBI's guidance on business email compromise is available at https://www.fbi.gov/how-we-can-help-you/common-frauds-and-scams/business-email-compromise.