Imagine your finance department receives an invoice from a supplier your company has worked with for several years. The amount looks correct, the company logo is familiar and the payment is due.
A few minutes later, another email arrives explaining that the supplier has changed its banking details. The message sounds professional and includes a replacement invoice.
Your accounts department updates the payment information and processes the transaction.
Everything appears normal until the actual supplier calls to ask why their invoice remains unpaid.
The money has gone to a criminal’s account.
This type of fraud is known as supplier invoice fraud, and it is one of the risks businesses face when criminals exploit email, trust and ordinary payment procedures.
For businesses in Zimbabwe, where companies regularly communicate with suppliers, contractors and customers through email and WhatsApp, payment verification should be treated as an essential part of financial security.
This guide explains how fake supplier invoices work, the warning signs to look for, how to protect business payments and what to do if your organisation becomes a victim.
What Is Supplier Invoice Fraud?
Supplier invoice fraud occurs when criminals manipulate an invoice or payment instruction to redirect money intended for a legitimate supplier into an account they control.
The fraudster may impersonate a supplier, compromise a genuine email account or alter an invoice so that the payment details are fraudulent.
The invoice may contain the correct company name, logo, description of services and outstanding amount. The only significant difference may be the bank account receiving the money.
This makes the scam particularly dangerous.
An employee who checks only the invoice amount and supplier name may not notice that the payment instructions have changed.
Supplier invoice fraud is closely associated with Business Email Compromise (BEC), a form of cybercrime in which criminals use impersonation or compromised email accounts to manipulate business transactions.
The FBI identifies fraudulent supplier payment instructions as one of the recognised forms of Business Email Compromise. https://www.fbi.gov/how-we-can-help-you/common-frauds-and-scams/business-email-compromise
How Do Fake Supplier Invoice Scams Work?
There are several ways criminals can manipulate supplier payments. Understanding these methods helps businesses identify suspicious activity before money leaves their accounts.
1. Changing Bank Details on a Genuine Invoice
This is one of the most straightforward forms of invoice fraud.
A criminal obtains a legitimate invoice and changes the payment details before sending it to the customer.
The document may retain the supplier’s logo, company name, invoice number and description of services.
The customer receives what appears to be an ordinary invoice but pays into a fraudulent account.
The fraud may be discovered only when the genuine supplier follows up for payment.
2. Impersonating a Supplier Through Email
A criminal creates an email address that looks similar to the supplier’s legitimate address.
For example:
- Genuine:
[email protected] - Fake:
[email protected]
The difference may be difficult to notice, especially on a mobile phone.
The attacker then sends an invoice or payment instruction that appears to come from the supplier.
In other cases, criminals compromise the supplier’s actual email account and send messages from it.
This is particularly concerning because the email may appear completely legitimate.
3. Compromising an Existing Email Conversation
Some invoice scams involve criminals gaining access to a legitimate email account.
They may monitor conversations between a business and its suppliers, learn when invoices are expected and wait for an opportunity to interfere.
When a payment is due, the attacker sends a message requesting that the funds be transferred to different banking details.
Because the message appears within an existing conversation, the recipient may not suspect that anything is wrong.
This is one reason why checking the sender’s name alone is not sufficient.
4. Pretending to Be a Company Director
Invoice fraud does not always involve impersonating suppliers.
Criminals may pretend to be a managing director, finance manager or company owner and instruct an employee to make an urgent payment.
The message may claim that the payment is confidential or must be completed before the end of the day.
An employee who feels pressured to follow instructions may bypass the normal approval process.
This is commonly associated with executive impersonation or CEO fraud.
5. Using WhatsApp to Change Payment Instructions
Businesses in Zimbabwe frequently use WhatsApp to communicate with suppliers and customers.
Although convenient, WhatsApp messages can also be used to manipulate payment processes.
A criminal may impersonate a supplier or take control of an existing account and send a message explaining that the company’s bank account has changed.
They may even send a replacement invoice as a PDF.
The fact that a message comes from a familiar phone number or WhatsApp profile does not automatically prove that the request is genuine.
Businesses should independently verify important payment changes before updating their records.
9 Warning Signs of a Fake Supplier Invoice
A fraudulent invoice may look convincing, but there are often clues that something is wrong.
Finance employees should be trained to recognise these warning signs.
1. The Supplier Suddenly Changes Banking Details
A supplier requesting a change of bank account should immediately trigger additional verification.
There may be legitimate reasons for changing banking details, but the request should never be accepted based solely on an email or WhatsApp message.
2. The Email Address Looks Slightly Different
Criminals frequently use addresses that resemble legitimate company domains.
A missing letter, extra character or different domain extension can be enough to deceive someone who is not paying close attention.
Always inspect the full sender address rather than relying on the displayed contact name.
3. The Request Creates Unusual Urgency
Messages such as these should raise concern:
- “Please process this immediately.”
- “Our account will be closed today.”
- “Payment must be made before close of business.”
- “Do not delay, as this is a confidential matter.”
- “We will not accept payment into the previous account.”
Urgency is often used to discourage verification.
A genuine supplier should understand that a business needs to verify changes to payment information.
4. The Invoice Uses Different Banking Information
Compare the new invoice with previous invoices.
Look for changes in:
- Bank name.
- Account number.
- Account holder.
- Branch information.
- Payment currency.
- Payment reference.
- Other payment instructions.
Even a small change deserves attention.
5. The Supplier Asks You to Use a Different Communication Channel
A supplier who normally communicates through an official company email address may suddenly request that future correspondence take place through a personal email address or an unfamiliar WhatsApp number.
This may be legitimate, but it should be verified independently.
6. The Invoice Contains Unexpected Changes
Look for differences in the invoice number, formatting, company information, contact details or payment instructions.
An altered document may retain most of the original information while replacing only the bank account details.
7. The Sender Refuses Independent Verification
A genuine supplier should normally be willing to confirm its banking details through an established communication channel.
If someone becomes unusually defensive when asked to verify a payment change, pause the transaction.
8. The Payment Instructions Do Not Match Previous Transactions
Compare the new instructions with the supplier information already recorded in your accounting system.
A new account, unfamiliar beneficiary or unexpected payment method should be investigated.
9. The Message Requests Secrecy or Bypassing Approval
Any request to ignore normal finance procedures is a warning sign.
For example, a message from someone claiming to be the managing director may ask an accountant to make a payment without informing the finance manager.
Payment controls exist to protect the organisation. They should not be abandoned because someone claims an instruction is urgent.
How to Prevent Fake Supplier Invoices in Your Business
Preventing invoice fraud requires more than asking employees to be careful.
Businesses need clear payment procedures that make it difficult for an attacker to redirect money without being detected.
The following controls are practical for organisations of different sizes.
1. Verify Every Change in Supplier Banking Details
This is one of the most important rules.
Whenever a supplier requests a change in payment details, verify the request using a communication channel that is independent of the message containing the new information.
For example, if the request arrives by email, call the supplier using a telephone number already held in your records.
Do not rely on a phone number included in the suspicious email or replacement invoice.
Ask an authorised representative to confirm:
- That the change is genuine.
- The new account holder.
- The bank name.
- The account number.
- The date from which the change applies.
Record the verification and the person who approved it.
The FBI and other cybersecurity authorities specifically recommend independent verification of payment changes using previously known contact details. https://www.ic3.gov/CrimeInfo/BEC
2. Introduce Two-Person Payment Approval
One employee should not have unrestricted authority to change supplier information and release a payment without independent review.
Businesses should separate important financial responsibilities.
For example:
- An accounts employee receives the invoice.
- A finance manager verifies the supplier and payment details.
- An authorised signatory approves the transaction.
- A separate person reviews the payment confirmation.
Smaller organisations may not have enough employees for complete separation of duties. In that case, a director or another authorised person can provide independent approval.
The important thing is to ensure that significant payment changes are not approved by one person acting alone.
3. Maintain a Verified Supplier Database
Keep a central record of approved suppliers and their verified payment information.
The database should contain:
- Registered supplier name.
- Company contact details.
- Approved banking information.
- Authorised representatives.
- Date the information was verified.
- Person responsible for verification.
When a supplier requests a change, update the records only after completing the verification process.
This reduces the risk of employees relying on whichever invoice happens to be in their inbox.
4. Protect Business Email Accounts
Email compromise is a major risk because attackers may use legitimate accounts to manipulate financial transactions.
Businesses should strengthen email security by:
- Using strong, unique passwords.
- Enabling multi-factor authentication.
- Restricting account access.
- Reviewing suspicious login activity.
- Removing access for former employees.
- Monitoring unusual email forwarding rules.
- Training employees to recognise phishing messages.
Email authentication technologies such as SPF, DKIM and DMARC can also help reduce certain forms of domain impersonation.
They do not prevent every form of email fraud, but they are useful components of a broader email security strategy.
5. Train Finance Employees and Managers
Finance teams are among the employees most likely to encounter fraudulent payment instructions.
Training should cover:
- Fake supplier invoices.
- Email impersonation.
- Executive impersonation.
- Suspicious bank account changes.
- Phishing attachments.
- Unusual payment requests.
- Independent verification procedures.
Employees should know that they will not be penalised for pausing a payment to verify suspicious instructions.
In fact, stopping an unusual payment for verification may prevent a significant financial loss.
6. Secure Supplier Communication Channels
Businesses should establish which communication channels are approved for financial instructions.
For example, a company may require official email correspondence for invoices while accepting WhatsApp for general communication.
However, even an official email account can be compromised.
The key is to ensure that sensitive changes, especially banking information, receive independent confirmation.
7. Use Email Security and Anti-Phishing Protection
Business email security can help detect suspicious messages, malicious attachments, impersonation attempts and other threats.
Some solutions also provide additional protection against lookalike domains and business email compromise.
For organisations that rely heavily on email, this is an important part of their cybersecurity strategy.
Tremhost offers Armor Mail, a managed email security service designed to provide additional protection for supported business email environments.
Explore: https://tremhost.com/armormail
8. Monitor Business Email Accounts
Unexpected forwarding rules, suspicious logins and unusual account activity can indicate that an email account has been compromised.
Businesses should review security alerts and investigate unexpected changes.
For Microsoft 365 and Google Workspace environments, administrators should also review account security settings, sign-in activity and mailbox rules.
A compromised mailbox may allow attackers to monitor supplier conversations and prepare convincing fraudulent invoices.
9. Establish a Written Payment Verification Policy
A business should have a documented procedure that explains what employees must do before changing supplier payment information.
The policy should specify:
- Who can request supplier detail changes.
- Who verifies those requests.
- Which contact details must be used.
- Who approves the changes.
- How evidence of verification is recorded.
- What happens when a request appears suspicious.
The procedure should apply consistently, even when the request comes from a senior executive or a long-standing supplier.
A Practical Supplier Payment Verification Procedure
A business does not need a complicated financial system to introduce better payment controls.
The following process can help reduce the risk of fraudulent payment instructions.
Step 1: Receive the invoice.
Record the invoice and compare it with the supplier’s existing information.
Step 2: Identify changes.
Check whether the bank details, contact information or payment instructions differ from previous verified records.
Step 3: Pause payment if details have changed.
Do not update the supplier’s payment information until the request has been independently confirmed.
Step 4: Contact the supplier independently.
Use a telephone number or contact method already held in the company’s records.
Step 5: Confirm the new details.
Ask an authorised supplier representative to confirm the banking information.
Step 6: Obtain internal approval.
Have the required finance manager or authorised signatory approve the change.
Step 7: Update the supplier record.
Record who verified and approved the new details, together with the date.
Step 8: Process the payment.
Only release payment after all required checks have been completed.
This process may take a few additional minutes, but it can prevent a much more expensive problem.
What Should You Do If Your Business Has Already Paid a Fake Invoice?
If your organisation discovers that it has transferred money to a fraudulent account, time is critical.
Do not wait until the next working day or until you have completed an internal investigation.
Take the following steps immediately.
1. Contact Your Bank
Contact your bank through its official communication channels.
Explain that the payment may have resulted from fraud and request urgent assistance with a recall, reversal or beneficiary-bank notification where possible.
Provide the transaction reference, amount, payment date and beneficiary information.
Recovery is not guaranteed, but acting quickly may improve the chances of intervention.
2. Contact the Genuine Supplier
Inform the actual supplier that their payment details may have been impersonated or compromised.
They may also need to investigate their email accounts and notify other customers.
3. Preserve the Evidence
Keep copies of:
- The fraudulent invoice.
- Original supplier invoices.
- Emails and message headers.
- WhatsApp conversations.
- Payment confirmations.
- Bank correspondence.
- Relevant account activity.
Do not delete suspicious messages, as they may help investigators establish how the fraud occurred.
4. Secure Compromised Accounts
If an email account may have been compromised, change its password, revoke suspicious sessions, enable multi-factor authentication and review forwarding rules.
Also investigate whether other company accounts may have been accessed.
5. Report the Incident
Report the incident to the appropriate law enforcement and relevant authorities in Zimbabwe. Contact your bank’s fraud department and ask what formal reporting information it requires.
Where personal information has been compromised, the business should also assess its obligations under Zimbabwe’s Cyber and Data Protection Act and applicable regulations.
6. Review the Payment Process
Once the immediate incident has been addressed, investigate how the fraudulent instruction passed through the organisation.
Was there no verification procedure? Did an employee rely on an email alone? Was a mailbox compromised? Could a second approval have stopped the transaction?
Use the findings to strengthen the business’s payment controls.
Why Traditional Antivirus Alone Cannot Prevent Invoice Fraud
One important misconception is that installing antivirus software automatically protects a business against financial scams.
Antivirus is useful for detecting and blocking malicious software, but supplier invoice fraud often relies on deception rather than malware.
A criminal may send a perfectly ordinary-looking PDF invoice with fraudulent banking details. The file itself may contain no malicious software.
An employee reads it, believes it is genuine and authorises payment.
No antivirus product can reliably determine whether every legitimate-looking banking instruction is actually authorised by the supplier.
That is why businesses need multiple layers of protection.
These should include:
- Email security.
- Multi-factor authentication.
- Employee awareness training.
- Independent payment verification.
- Internal approval controls.
- Endpoint protection.
- Monitoring of business accounts.
The strongest approach combines technology with sensible financial procedures.
How Tremhost Helps Businesses Reduce Email and Cybersecurity Risks
Tremhost provides cybersecurity services designed to help organisations strengthen protection across their websites, email systems and employee devices.
Supplier invoice fraud often involves compromised email accounts, impersonation and malicious attachments. Businesses therefore need to protect the systems through which financial instructions are communicated.
Tremhost offers several services that can support this effort.
Armor Mail: Additional Business Email Protection
Armor Mail is designed to provide additional protection for supported business email environments.
Its published offering includes protection against phishing, business email compromise, fake invoices, suspicious attachments and impersonation attempts.
It is particularly relevant to organisations that depend on email for supplier communication, financial instructions and customer correspondence.
Explore: https://tremhost.com/armormail
ESET Security: Protect Business Computers
ESET provides endpoint protection for business computers and servers.
Endpoint security can help detect malicious files and suspicious activity on devices employees use to access email, accounting systems and business records.
Tremhost offers several ESET business security tiers.
Explore: https://tremhost.com/eset-security
Armor Workforce: Strengthen Staff Access
Businesses should control who can access internal applications and business resources.
Armor Workforce provides a managed Cloudflare Zero Trust offering designed to help organisations apply access policies and improve control over staff access.
Explore: https://tremhost.com/armorworkforce
Managed Cybersecurity
Organisations that need broader protection can consider Tremhost’s managed cybersecurity services.
Depending on the selected package, services can include email security, endpoint protection, website security, vulnerability scanning and other agreed security controls.
Explore: https://tremhost.com/managedsecurity
It is important to remember that cybersecurity technology supports financial controls; it does not replace them. Businesses must still independently verify supplier banking changes and maintain proper payment approvals.
Final Thoughts: Verify Before You Pay
Supplier invoice fraud succeeds because it exploits something every business depends on: trust.
An accountant trusts an established supplier. A director trusts a familiar employee. A finance manager trusts an email that appears to come from a known company.
Criminals understand these relationships and use them to make fraudulent instructions look ordinary.
The solution is not to stop trusting suppliers or abandon digital communication. It is to introduce verification procedures that make it difficult for someone to manipulate a payment without being detected.
Every business should have a clear process for confirming changes to supplier banking details, protecting email accounts and approving significant payments.
A few minutes spent verifying an invoice can prevent a serious financial loss.
Protect your business communications with Tremhost. Explore Armor Mail and other cybersecurity services at https://tremhost.com/armormail and strengthen the systems your organisation relies on every day.
Frequently Asked Questions
What is a fake supplier invoice?
A fake supplier invoice is a fraudulent payment document designed to make a business send money to an account controlled by a criminal. It may contain altered banking details or impersonate a genuine supplier.
How do I identify a fake supplier invoice?
Check the supplier’s email address, invoice details, payment instructions and bank account information against previously verified records. Be especially cautious when banking details change unexpectedly or the sender creates urgency.
Can a supplier’s real email account be used for invoice fraud?
Yes. Criminals may compromise a legitimate email account and use it to send fraudulent invoices or payment instructions. This can make the messages particularly convincing.
Should I trust a supplier’s WhatsApp message changing bank details?
No payment change should be accepted solely because it arrives through WhatsApp. Verify the request independently using contact details already held in your business records.
How can a business prevent supplier invoice fraud?
Use independent verification for banking changes, two-person payment approval, strong email security, multi-factor authentication, staff training and a verified supplier database.
What is Business Email Compromise?
Business Email Compromise is a scam in which criminals use impersonation or compromised email accounts to manipulate business transactions, obtain information or redirect payments.
Can antivirus detect fake invoices?
Antivirus can detect malicious files and attachments, but it cannot reliably determine whether ordinary banking details on a legitimate-looking PDF are genuine. Payment verification and email security are also necessary.
What should I do if I have paid a fraudulent invoice?
Contact your bank immediately and request urgent assistance. Inform the genuine supplier, preserve evidence, secure potentially compromised accounts and report the incident to the appropriate authorities.
Does email security prevent all supplier invoice fraud?
No. Email security can reduce exposure to phishing, malicious attachments and impersonation attempts, but it cannot eliminate every fraud scenario. Independent payment verification remains essential.
Can Tremhost help protect my business from fake invoice scams?
Tremhost offers Armor Mail for additional business email protection, ESET endpoint security and broader managed cybersecurity services. These can support a wider fraud prevention programme alongside internal payment controls.
