Fake invoices from suppliers you really use.

What's happening.

Business email compromise, also called business payment fraud, is when a criminal sends an invoice that looks real but asks you to pay a different bank account. The email may come from a supplier's hacked mailbox, or from an address that looks almost the same.

The NCSC and Australia's ASD both describe the same pattern: a real vendor's email is taken over, and the bank details on genuine invoices are changed.

What it means for you.

Money sent to a criminal's account is hard to get back. For a small business, one invoice can be a month's profit. The same trick can also attach malware to a fake invoice.

How to fix it.

1. Check any change of bank details by phoning the supplier on a number you already hold. Do not use a number from the email.
2. Use a second way to confirm large or unusual payments, such as a text, a call or in person.
3. Set up SPF, DKIM and DMARC on your own domain so criminals cannot easily send email that looks like yours. Our email domain check tests all three.
4. Tell your own customers that your bank details never change by email.
5. Turn on multi-factor authentication for every mailbox, starting with whoever handles payments.
6. If you have paid the wrong account, tell your bank straight away using the phone number on its official website.