Invoice fraud is a scam where an attacker poses as a real supplier or customer to redirect a payment, change the bank account on an invoice, or bill you for something you never ordered. It is the highest-loss attack category for many Australian small businesses, and it is aimed at finance and admin staff — the people who pay invoices. The average self-reported cost of a cybercrime incident reached $56,600 for an Australian small business in FY2024-25 (ASD Annual Cyber Threat Report 2024-25), and a single redirected payment can exceed that figure on its own. The hidden cost people miss: recovery odds collapse within a day, so the control that matters is verification before payment — not chasing the transfer afterwards.
TL;DR
- Invoice fraud is payment fraud through a fake or tampered invoice — usually a supplier's bank-details change or a fake executive request.
- Australian small businesses averaged $56,600 self-reported cost per cybercrime incident in FY2024-25; one redirected payment can exceed it.
- The core rule: any bank-detail change is treated as fraud until verified by phone, on a number you already hold.
- A two-person rule for payments above a threshold catches the lone-employee scenario.
- Fast reporting matters: money recalled within hours has a real recovery chance; after a day it rarely comes back.
What is invoice fraud?
Invoice fraud — also called payment redirection or business email compromise in its payment form — works because the request looks like routine business. An invoice arrives from a supplier you know, on their letterhead, quoting a real purchase order number, asking to update payment details before settlement. Everything about it is normal except the destination account.
The Australian Signals Directorate logged more than 84,700 cybercrime reports in FY2024-25, one every six minutes, with business email compromise making up 15% of business reports. Invoice fraud is the most expensive expression of that category: no malware, no broken system, just a payment that went to the wrong account because one email was believed.
How invoice fraud works
- Study. The attacker learns who you buy from and how you pay — often from public records, LinkedIn, or a compromised mailbox inside your own or the supplier's business.
- Insert. The fake email is timed to a real payment cycle: ahead of a genuine invoice's due date, so the change feels expected. Sometimes it sits inside a real email thread that was hijacked after the supplier's mailbox was compromised.
- Redirect. The payment details change — a new bank account, a new remittance email — usually with a plausible reason: a new bank, a system migration, an accounts clerk change.
- Pressure. Urgency and authority do the rest: the invoice is overdue, the director needs it settled before an audit, the supplier threatens to pause supply.
- Cashout. The mule account forwards the money within hours. By the time the real supplier chases the unpaid invoice, recovery odds have collapsed.
The three most common versions
| Version | What it looks like | The tell |
|---|---|---|
| Supplier bank-detail change | A familiar supplier emails updated payment details before an invoice falls due | Verified by phone on a number already on file — never one from the email |
| Fake invoice from the executive | The CEO or owner emails asking for an urgent, confidential payment to close a deal | Verified through a channel you already trust; legitimate deals do not need secrecy from finance |
| Hijacked thread | A real email thread with the supplier continues — then the attachment quietly changes | Compare the bank details against the last successfully paid invoice, every time |
Why email filters cannot stop it
Email security catches malicious links and attachments. The most expensive invoice-fraud emails carry neither: plain text, a valid signature, a lookalike domain, and details copied from a real thread. Roughly 60% of breaches involve a human element (Verizon, 2025 DBIR) — and invoice fraud is the purest example: the system works exactly as designed, and the person pays the wrong account.
That is why the defence is procedure plus training. Monthly security awareness training builds the verification reflex, human risk reporting shows whether finance and admin teams are improving, and phishing simulations with payment-fraud scenarios rehearse the moment a real attack exploits.
How to stop invoice fraud: five controls
- Out-of-band verification. Every bank-detail change is confirmed by phone on a number you already hold — from a past invoice, the supplier's website, your CRM. Never the number in the email.
- Two-person rule. Payments above a set threshold need two approvers. It catches the scenario where one busy employee is the whole control.
- Compare against history. Keep the last paid invoice's bank details on file and diff every new one against them.
- Train finance and admin first. Short monthly modules on payment fraud, plus simulations that rehearse the verification step — the two attacks behind the largest reported losses for Australian small businesses.
- Act fast when it happens. Call your bank immediately to attempt recall, report to ReportCyber, and tell the real supplier their identity is being used.
Is invoice fraud the same as phishing?
No — phishing is the delivery method; invoice fraud is the outcome. Most invoice fraud arrives by phishing email, and the most damaging versions are plain text with no link at all. Treat every unexpected invoice or payment-detail request as a phishing lure until verified.
What should I do if we already paid a fraudulent invoice?
Immediately: call your bank and attempt recall, then report to ReportCyber and Scamwatch. Then notify the real supplier — their domain may be compromised — and review which control failed: the verification step, the approval threshold, or both.
How much does invoice fraud cost a small business?
The ASD's FY2024-25 average for a small-business cybercrime incident was $56,600 self-reported — and a single redirected supplier payment commonly runs into the tens of thousands. Prevention is a procedure and a training programme; the annual training line is a fraction of one redirected payment.
FAQ
What is invoice fraud? A scam that redirects a legitimate payment: an attacker poses as a supplier or executive to change bank details, send a fake invoice or hijack a real payment thread.
What is payment redirection fraud? The same thing by another name — the payment you owe a genuine supplier is redirected to the attacker's account through a convincing payment-detail change.
How do I verify a bank-detail change safely? Call the supplier on a number you already hold — a past invoice or their website — and confirm verbally with a known contact. Never use contact details supplied in the email making the request.
Can email filters catch invoice fraud? Rarely. The most expensive versions are plain-text emails with no link or attachment, from a lookalike domain or a compromised real mailbox.
Who should be trained against invoice fraud? Finance and accounts staff first, then anyone who approves payments or manages supplier relationships — and executives, who are the most impersonated group in the business.
What is the two-person rule? A control requiring two people to approve any payment above a set threshold, so a single manipulated or deceived employee cannot move the money alone.
One last thing
The businesses that beat invoice fraud are not the ones with the best filters — they are the ones where a payment-detail change being questioned is normal, expected, even praised. Make the phone call part of the payment process, and the attack loses its entire entry point.