Imagine your finance department receives an invoice from a supplier your company has worked with for several years. The amount looks correct, the company logo is familiar and the payment is due.<\/p>\n
A few minutes later, another email arrives explaining that the supplier has changed its banking details. The message sounds professional and includes a replacement invoice.<\/p>\n
Your accounts department updates the payment information and processes the transaction.<\/p>\n
Everything appears normal until the actual supplier calls to ask why their invoice remains unpaid.<\/p>\n
The money has gone to a criminal’s account.<\/p>\n
This type of fraud is known as supplier invoice fraud, and it is one of the risks businesses face when criminals exploit email, trust and ordinary payment procedures.<\/p>\n
For businesses in Zimbabwe, where companies regularly communicate with suppliers, contractors and customers through email and WhatsApp, payment verification should be treated as an essential part of financial security.<\/p>\n
This guide explains how fake supplier invoices work, the warning signs to look for, how to protect business payments and what to do if your organisation becomes a victim.<\/p>\n
Supplier invoice fraud occurs when criminals manipulate an invoice or payment instruction to redirect money intended for a legitimate supplier into an account they control.<\/p>\n
The fraudster may impersonate a supplier, compromise a genuine email account or alter an invoice so that the payment details are fraudulent.<\/p>\n
The invoice may contain the correct company name, logo, description of services and outstanding amount. The only significant difference may be the bank account receiving the money.<\/p>\n
This makes the scam particularly dangerous.<\/p>\n
An employee who checks only the invoice amount and supplier name may not notice that the payment instructions have changed.<\/p>\n
Supplier invoice fraud is closely associated with Business Email Compromise (BEC), a form of cybercrime in which criminals use impersonation or compromised email accounts to manipulate business transactions.<\/p>\n
The FBI identifies fraudulent supplier payment instructions as one of the recognised forms of Business Email Compromise. https:\/\/www.fbi.gov\/how-we-can-help-you\/common-frauds-and-scams\/business-email-compromise<\/a><\/p>\n There are several ways criminals can manipulate supplier payments. Understanding these methods helps businesses identify suspicious activity before money leaves their accounts.<\/p>\n This is one of the most straightforward forms of invoice fraud.<\/p>\n A criminal obtains a legitimate invoice and changes the payment details before sending it to the customer.<\/p>\n The document may retain the supplier’s logo, company name, invoice number and description of services.<\/p>\n The customer receives what appears to be an ordinary invoice but pays into a fraudulent account.<\/p>\n The fraud may be discovered only when the genuine supplier follows up for payment.<\/p>\n A criminal creates an email address that looks similar to the supplier’s legitimate address.<\/p>\n For example:<\/p>\n The difference may be difficult to notice, especially on a mobile phone.<\/p>\n The attacker then sends an invoice or payment instruction that appears to come from the supplier.<\/p>\n In other cases, criminals compromise the supplier’s actual email account and send messages from it.<\/p>\n This is particularly concerning because the email may appear completely legitimate.<\/p>\n Some invoice scams involve criminals gaining access to a legitimate email account.<\/p>\n They may monitor conversations between a business and its suppliers, learn when invoices are expected and wait for an opportunity to interfere.<\/p>\n When a payment is due, the attacker sends a message requesting that the funds be transferred to different banking details.<\/p>\n Because the message appears within an existing conversation, the recipient may not suspect that anything is wrong.<\/p>\n This is one reason why checking the sender’s name alone is not sufficient.<\/p>\n Invoice fraud does not always involve impersonating suppliers.<\/p>\n Criminals may pretend to be a managing director, finance manager or company owner and instruct an employee to make an urgent payment.<\/p>\n The message may claim that the payment is confidential or must be completed before the end of the day.<\/p>\n An employee who feels pressured to follow instructions may bypass the normal approval process.<\/p>\n This is commonly associated with executive impersonation or CEO fraud.<\/p>\n Businesses in Zimbabwe frequently use WhatsApp to communicate with suppliers and customers.<\/p>\n Although convenient, WhatsApp messages can also be used to manipulate payment processes.<\/p>\n A criminal may impersonate a supplier or take control of an existing account and send a message explaining that the company’s bank account has changed.<\/p>\n They may even send a replacement invoice as a PDF.<\/p>\n The fact that a message comes from a familiar phone number or WhatsApp profile does not automatically prove that the request is genuine.<\/p>\n Businesses should independently verify important payment changes before updating their records.<\/p>\n A fraudulent invoice may look convincing, but there are often clues that something is wrong.<\/p>\n Finance employees should be trained to recognise these warning signs.<\/p>\n A supplier requesting a change of bank account should immediately trigger additional verification.<\/p>\n There may be legitimate reasons for changing banking details, but the request should never be accepted based solely on an email or WhatsApp message.<\/p>\n Criminals frequently use addresses that resemble legitimate company domains.<\/p>\n A missing letter, extra character or different domain extension can be enough to deceive someone who is not paying close attention.<\/p>\n Always inspect the full sender address rather than relying on the displayed contact name.<\/p>\n Messages such as these should raise concern:<\/p>\n Urgency is often used to discourage verification.<\/p>\n A genuine supplier should understand that a business needs to verify changes to payment information.<\/p>\n Compare the new invoice with previous invoices.<\/p>\n Look for changes in:<\/p>\n Even a small change deserves attention.<\/p>\n A supplier who normally communicates through an official company email address may suddenly request that future correspondence take place through a personal email address or an unfamiliar WhatsApp number.<\/p>\n This may be legitimate, but it should be verified independently.<\/p>\n Look for differences in the invoice number, formatting, company information, contact details or payment instructions.<\/p>\n An altered document may retain most of the original information while replacing only the bank account details.<\/p>\n A genuine supplier should normally be willing to confirm its banking details through an established communication channel.<\/p>\n If someone becomes unusually defensive when asked to verify a payment change, pause the transaction.<\/p>\n Compare the new instructions with the supplier information already recorded in your accounting system.<\/p>\n A new account, unfamiliar beneficiary or unexpected payment method should be investigated.<\/p>\n Any request to ignore normal finance procedures is a warning sign.<\/p>\n For example, a message from someone claiming to be the managing director may ask an accountant to make a payment without informing the finance manager.<\/p>\n Payment controls exist to protect the organisation. They should not be abandoned because someone claims an instruction is urgent.<\/p>\n Preventing invoice fraud requires more than asking employees to be careful.<\/p>\n Businesses need clear payment procedures that make it difficult for an attacker to redirect money without being detected.<\/p>\n The following controls are practical for organisations of different sizes.<\/p>\n This is one of the most important rules.<\/p>\n Whenever a supplier requests a change in payment details, verify the request using a communication channel that is independent of the message containing the new information.<\/p>\n For example, if the request arrives by email, call the supplier using a telephone number already held in your records.<\/p>\n Do not rely on a phone number included in the suspicious email or replacement invoice.<\/p>\n Ask an authorised representative to confirm:<\/p>\n Record the verification and the person who approved it.<\/p>\n The FBI and other cybersecurity authorities specifically recommend independent verification of payment changes using previously known contact details. https:\/\/www.ic3.gov\/CrimeInfo\/BEC<\/a><\/p>\n One employee should not have unrestricted authority to change supplier information and release a payment without independent review.<\/p>\n Businesses should separate important financial responsibilities.<\/p>\n For example:<\/p>\n Smaller organisations may not have enough employees for complete separation of duties. In that case, a director or another authorised person can provide independent approval.<\/p>\n The important thing is to ensure that significant payment changes are not approved by one person acting alone.<\/p>\n Keep a central record of approved suppliers and their verified payment information.<\/p>\n The database should contain:<\/p>\n When a supplier requests a change, update the records only after completing the verification process.<\/p>\n This reduces the risk of employees relying on whichever invoice happens to be in their inbox.<\/p>\n Email compromise is a major risk because attackers may use legitimate accounts to manipulate financial transactions.<\/p>\n Businesses should strengthen email security by:<\/p>\n Email authentication technologies such as SPF, DKIM and DMARC can also help reduce certain forms of domain impersonation.<\/p>\n They do not prevent every form of email fraud, but they are useful components of a broader email security strategy.<\/p>\n Finance teams are among the employees most likely to encounter fraudulent payment instructions.<\/p>\n Training should cover:<\/p>\n Employees should know that they will not be penalised for pausing a payment to verify suspicious instructions.<\/p>\n In fact, stopping an unusual payment for verification may prevent a significant financial loss.<\/p>\n Businesses should establish which communication channels are approved for financial instructions.<\/p>\n For example, a company may require official email correspondence for invoices while accepting WhatsApp for general communication.<\/p>\n However, even an official email account can be compromised.<\/p>\n The key is to ensure that sensitive changes, especially banking information, receive independent confirmation.<\/p>\n Business email security can help detect suspicious messages, malicious attachments, impersonation attempts and other threats.<\/p>\n Some solutions also provide additional protection against lookalike domains and business email compromise.<\/p>\n For organisations that rely heavily on email, this is an important part of their cybersecurity strategy.<\/p>\n Tremhost offers Armor Mail, a managed email security service designed to provide additional protection for supported business email environments.<\/p>\n Explore: https:\/\/tremhost.com\/armormail<\/a><\/p>\n Unexpected forwarding rules, suspicious logins and unusual account activity can indicate that an email account has been compromised.<\/p>\n Businesses should review security alerts and investigate unexpected changes.<\/p>\n For Microsoft 365 and Google Workspace environments, administrators should also review account security settings, sign-in activity and mailbox rules.<\/p>\n A compromised mailbox may allow attackers to monitor supplier conversations and prepare convincing fraudulent invoices.<\/p>\n A business should have a documented procedure that explains what employees must do before changing supplier payment information.<\/p>\n The policy should specify:<\/p>\n The procedure should apply consistently, even when the request comes from a senior executive or a long-standing supplier.<\/p>\n A business does not need a complicated financial system to introduce better payment controls.<\/p>\n The following process can help reduce the risk of fraudulent payment instructions.<\/p>\n Step 1: Receive the invoice.<\/strong><\/p>\n Record the invoice and compare it with the supplier’s existing information.<\/p>\n Step 2: Identify changes.<\/strong><\/p>\n Check whether the bank details, contact information or payment instructions differ from previous verified records.<\/p>\n Step 3: Pause payment if details have changed.<\/strong><\/p>\n Do not update the supplier’s payment information until the request has been independently confirmed.<\/p>\n Step 4: Contact the supplier independently.<\/strong><\/p>\n Use a telephone number or contact method already held in the company’s records.<\/p>\n Step 5: Confirm the new details.<\/strong><\/p>\n Ask an authorised supplier representative to confirm the banking information.<\/p>\n Step 6: Obtain internal approval.<\/strong><\/p>\n Have the required finance manager or authorised signatory approve the change.<\/p>\n Step 7: Update the supplier record.<\/strong><\/p>\n Record who verified and approved the new details, together with the date.<\/p>\n Step 8: Process the payment.<\/strong><\/p>\n Only release payment after all required checks have been completed.<\/p>\n This process may take a few additional minutes, but it can prevent a much more expensive problem.<\/p>\n If your organisation discovers that it has transferred money to a fraudulent account, time is critical.<\/p>\n Do not wait until the next working day or until you have completed an internal investigation.<\/p>\n Take the following steps immediately.<\/p>\n Contact your bank through its official communication channels.<\/p>\n Explain that the payment may have resulted from fraud and request urgent assistance with a recall, reversal or beneficiary-bank notification where possible.<\/p>\n Provide the transaction reference, amount, payment date and beneficiary information.<\/p>\n Recovery is not guaranteed, but acting quickly may improve the chances of intervention.<\/p>\n Inform the actual supplier that their payment details may have been impersonated or compromised.<\/p>\n They may also need to investigate their email accounts and notify other customers.<\/p>\n Keep copies of:<\/p>\n Do not delete suspicious messages, as they may help investigators establish how the fraud occurred.<\/p>\n If an email account may have been compromised, change its password, revoke suspicious sessions, enable multi-factor authentication and review forwarding rules.<\/p>\n Also investigate whether other company accounts may have been accessed.<\/p>\n Report the incident to the appropriate law enforcement and relevant authorities in Zimbabwe. Contact your bank’s fraud department and ask what formal reporting information it requires.<\/p>\n Where personal information has been compromised, the business should also assess its obligations under Zimbabwe’s Cyber and Data Protection Act and applicable regulations.<\/p>\n Once the immediate incident has been addressed, investigate how the fraudulent instruction passed through the organisation.<\/p>\n Was there no verification procedure? Did an employee rely on an email alone? Was a mailbox compromised? Could a second approval have stopped the transaction?<\/p>\n Use the findings to strengthen the business’s payment controls.<\/p>\n One important misconception is that installing antivirus software automatically protects a business against financial scams.<\/p>\n Antivirus is useful for detecting and blocking malicious software, but supplier invoice fraud often relies on deception rather than malware.<\/p>\n A criminal may send a perfectly ordinary-looking PDF invoice with fraudulent banking details. The file itself may contain no malicious software.<\/p>\n An employee reads it, believes it is genuine and authorises payment.<\/p>\n No antivirus product can reliably determine whether every legitimate-looking banking instruction is actually authorised by the supplier.<\/p>\n That is why businesses need multiple layers of protection.<\/p>\n These should include:<\/p>\n The strongest approach combines technology with sensible financial procedures.<\/p>\n Tremhost provides cybersecurity services designed to help organisations strengthen protection across their websites, email systems and employee devices.<\/p>\n Supplier invoice fraud often involves compromised email accounts, impersonation and malicious attachments. Businesses therefore need to protect the systems through which financial instructions are communicated.<\/p>\n Tremhost offers several services that can support this effort.<\/p>\n Armor Mail is designed to provide additional protection for supported business email environments.<\/p>\n Its published offering includes protection against phishing, business email compromise, fake invoices, suspicious attachments and impersonation attempts.<\/p>\n It is particularly relevant to organisations that depend on email for supplier communication, financial instructions and customer correspondence.<\/p>\n Explore: https:\/\/tremhost.com\/armormail<\/a><\/p>\n ESET provides endpoint protection for business computers and servers.<\/p>\n Endpoint security can help detect malicious files and suspicious activity on devices employees use to access email, accounting systems and business records.<\/p>\n Tremhost offers several ESET business security tiers.<\/p>\n Explore: https:\/\/tremhost.com\/eset-security<\/a><\/p>\n Businesses should control who can access internal applications and business resources.<\/p>\n Armor Workforce provides a managed Cloudflare Zero Trust offering designed to help organisations apply access policies and improve control over staff access.<\/p>\n Explore: https:\/\/tremhost.com\/armorworkforce<\/a><\/p>\n Organisations that need broader protection can consider Tremhost’s managed cybersecurity services.<\/p>\n Depending on the selected package, services can include email security, endpoint protection, website security, vulnerability scanning and other agreed security controls.<\/p>\nHow Do Fake Supplier Invoice Scams Work?<\/h2>\n
1. Changing Bank Details on a Genuine Invoice<\/h3>\n
2. Impersonating a Supplier Through Email<\/h3>\n
\n
accounts@supplier.co.zw<\/code><\/li>\naccounts@supp1ier.co.zw<\/code><\/li>\n<\/ul>\n3. Compromising an Existing Email Conversation<\/h3>\n
4. Pretending to Be a Company Director<\/h3>\n
5. Using WhatsApp to Change Payment Instructions<\/h3>\n
9 Warning Signs of a Fake Supplier Invoice<\/h2>\n
1. The Supplier Suddenly Changes Banking Details<\/h3>\n
2. The Email Address Looks Slightly Different<\/h3>\n
3. The Request Creates Unusual Urgency<\/h3>\n
\n
4. The Invoice Uses Different Banking Information<\/h3>\n
\n
5. The Supplier Asks You to Use a Different Communication Channel<\/h3>\n
6. The Invoice Contains Unexpected Changes<\/h3>\n
7. The Sender Refuses Independent Verification<\/h3>\n
8. The Payment Instructions Do Not Match Previous Transactions<\/h3>\n
9. The Message Requests Secrecy or Bypassing Approval<\/h3>\n
How to Prevent Fake Supplier Invoices in Your Business<\/h2>\n
1. Verify Every Change in Supplier Banking Details<\/h3>\n
\n
2. Introduce Two-Person Payment Approval<\/h3>\n
\n
3. Maintain a Verified Supplier Database<\/h3>\n
\n
4. Protect Business Email Accounts<\/h3>\n
\n
5. Train Finance Employees and Managers<\/h3>\n
\n
6. Secure Supplier Communication Channels<\/h3>\n
7. Use Email Security and Anti-Phishing Protection<\/h3>\n
8. Monitor Business Email Accounts<\/h3>\n
9. Establish a Written Payment Verification Policy<\/h3>\n
\n
A Practical Supplier Payment Verification Procedure<\/h2>\n
What Should You Do If Your Business Has Already Paid a Fake Invoice?<\/h2>\n
1. Contact Your Bank<\/h3>\n
2. Contact the Genuine Supplier<\/h3>\n
3. Preserve the Evidence<\/h3>\n
\n
4. Secure Compromised Accounts<\/h3>\n
5. Report the Incident<\/h3>\n
6. Review the Payment Process<\/h3>\n
Why Traditional Antivirus Alone Cannot Prevent Invoice Fraud<\/h2>\n
\n
How Tremhost Helps Businesses Reduce Email and Cybersecurity Risks<\/h2>\n
Armor Mail: Additional Business Email Protection<\/h3>\n
ESET Security: Protect Business Computers<\/h3>\n
Armor Workforce: Strengthen Staff Access<\/h3>\n
Managed Cybersecurity<\/h3>\n