Invoice diversion scam: what to do

What an invoice diversion scam looks like

A supplier you already work with sends an invoice that looks normal, except the bank account has changed. The email might explain the change as a new branch, an audit, or a system upgrade.

Behind it, someone has broken into the supplier’s mailbox, or set up a domain that looks almost the same as the real one. They wait for a real invoice to fall due, then send their own version first.

Because the supplier relationship is real and the amount matches what you expected to pay, the request rarely raises suspicion on its own.

Why the new invoice looks genuine

The invoice number, logo, and format usually match previous ones exactly, because the scammer copied them from earlier correspondence. Only the bank account line has changed.

Finance teams under pressure to pay on time can process it alongside other routine invoices. The change is small compared to everything else on the page, so it is easy to miss.

By the time the supplier asks why payment has not arrived, the money has already gone to the wrong account.

Can a payment sent on a fake invoice be recovered

Recovery is most realistic within the first day, before the receiving account is emptied. Contact your bank the moment you suspect the invoice was fake and ask about a recall or a hold.

If days have passed, tracing becomes harder and a civil claim against the scammer may be the only route left, depending on the amount involved. No outcome can be promised in advance.

Keep paying the genuine supplier separately once you confirm their real account, so the relationship and the underlying deal are not lost as well.

The one check that stops it

Call the supplier on a phone number you already have, from an old invoice or your own contact records, never a number in the new email. Ask them to confirm the account change out loud.

A genuine supplier will not mind this call, and most will expect it. If a supplier resists being verified this way, treat the request as unconfirmed until you can reach them another route.

What to do first

Report the payment through the first actions after a scam so nothing is missed, including a call to the National Scam Response Centre on 997 if the transfer was recent. Read how a bank recall works to understand the timeline.

Make a police report with the fake invoice, the email headers, and the payment record attached. This gives the Commercial Crime Investigation Department (CCID) the details needed to trace the receiving account.