Invoice fraud, how the bank-detail scam works and how to stop it

Short answer. Business email compromise is the fraud where a criminal gets into or imitates a business mailbox and uses it to redirect a payment, usually with a plausible invoice carrying new bank details. It costs UK businesses more than ransomware does. It is stopped by three layers: making mailboxes hard to take over (MFA and conditional access), making your domain hard to impersonate (SPF, DKIM and DMARC), and a simple human rule that no bank detail change is ever acted on without a phone call to a known number.

I have helped two clients through this in the last year, one of whom was a law firm handling completion funds. The pattern is the same every time, which is what makes it preventable.

How the attack unfolds

Step one: the login. Someone receives an email that looks like a Microsoft sign-in, a shared document, or a voicemail notification. They enter their password on a copied login page. If multi-factor authentication is off, the criminal is in. If it is on but uses simple push approvals, they may spam approvals until someone taps yes.

Step two: the quiet phase. Nothing visible happens. The intruder sets up inbox rules: move anything mentioning “invoice” or “bank” to a hidden folder, forward copies externally, mark as read. They read months of email to learn who pays whom, when, and in what tone.

Step three: the moment. A genuine invoice is due. The intruder either edits it in flight, sends a follow-up from the real mailbox with “our bank details have changed”, or sets up a look-alike domain (yourcompany-ltd.co.uk instead of yourcompany.co.uk) and emails the client from there. The email is grammatically perfect, references the right project, and arrives when expected.

Step four: the payment. Money goes to a mule account and is moved on within hours. Recovery after the first day is rare.

The variation in law firms and conveyancers is the same thing aimed at completion funds. In construction it is subcontractor payments. In recruitment it is candidate payroll. The mechanism does not change.

Layer one: make mailboxes hard to take over

• Multi-factor authentication on every account, no exceptions for directors or the accounts mailbox. Use number matching in the Authenticator app rather than simple approve prompts, so approval fatigue does not work.
• Conditional access (included in Microsoft 365 Business Premium) so a login from an unexpected country or an unmanaged device is blocked outright, MFA or not.
• Alerts on inbox rules and forwarding. Microsoft can flag when a new rule or external forward appears. This is the single highest-value alert in a small business because it catches the quiet phase.
• Block legacy authentication, which bypasses MFA entirely and is still on in tenants that were set up years ago.
• Defender for Office 365 with impersonation protection configured for your directors and your key suppliers, so an email claiming to be from the finance director from an outside address is flagged.

Layer two: make your domain hard to impersonate

Three DNS records decide whether other people’s mail servers trust email claiming to be from you:

• SPF lists which servers may send as your domain.
• DKIM cryptographically signs messages so tampering is detectable.
• DMARC tells receiving servers what to do with mail that fails the other two, and sends you reports.

Most small businesses have SPF, half have DKIM, and very few have DMARC set to anything stronger than “monitor”. A DMARC policy of reject means a criminal cannot send email as you@yourdomain.co.uk and have it land. It takes a few weeks of monitoring reports to get there safely, and it is worth every one of them. Since 2024 the major mailbox providers also penalise senders without these records, so it helps your own deliverability too.

None of this stops a look-alike domain, which is why the third layer exists.

Layer three: the human rule

Write it down, tell every person who can make a payment, and put it in supplier onboarding:

No change to bank details is actioned on the strength of an email. Ring the supplier on the number you already hold, not one in the email, and confirm verbally.

Add a second person’s approval for any payment over a threshold you choose. Criminals rely on one busy person acting alone on a Friday afternoon. Two people and a phone call breaks the attack regardless of how good the email is.

The first hour if it happens

1. Ring the bank. Ask for a recall. Every minute counts; do this before anything else.
2. Reset the compromised password and revoke all sessions so the intruder is thrown out, then check MFA methods for ones you do not recognise.
3. Check inbox rules and forwarding on the affected mailbox and any others; delete what you find and note it.
4. Look at sign-in logs for where the intruder came from and what else they touched.
5. Warn the counterparties who may have received fraudulent emails from your domain.
6. Report to Action Fraud, tell your insurer, and assess whether personal data was accessed. If it was, the ICO must be told within 72 hours.

A good managed IT provider does steps two to four within the hour. The bank call is yours, and it is the one that recovers money.

Where to start this week

If you do only three things: turn on MFA everywhere with number matching, enable the inbox-rule alert, and send the bank-detail rule to everyone who pays invoices. Then get DMARC to reject over the following month. All of this is standard IT security work and the first two take an afternoon. If you are not sure where your tenant stands, book a call and I will check the five settings above while we talk. If you want the whole estate looked at independently, the IT & Security Audit does that in two weeks, from £1,500.