Fake invoice or changed bank account: how to spot email fraud

Invoice fraud, or business e-mail compromise (BEC), is one of the most expensive cyber scams for small businesses. No malware is needed: the fraudster sends a convincing e-mail with a supplier's "new bank account" or an urgent payment request from the boss, and your own employee makes the transfer. Here is how the scam works, how to recognise it and what to do if money has already gone.

How the scam works

• Lookalike domain. The e-mail comes from a domain that differs from the real supplier's by one character (for example "rn" instead of "m") or has a different ending (.com instead of .ee). On a phone you often see only the sender's name, not the address.
• Hacked supplier mailbox. The fraudster has taken over a real partner's account. The e-mail comes from the correct address because it really is sent from the partner's mailbox. The attacker reads the correspondence for weeks and waits for an invoice to be due.
• Reply in an existing thread. The fake message is a reply to your real conversation, with the full history below. It looks trustworthy, even though the sender or "Reply-To" address may have been quietly changed.
• "The CEO needs this urgently." An e-mail in the managing director's name: "I'm in a meeting, can't talk, this payment must go out today, keep it confidential." Sometimes the request is to buy gift cards.

Red flags

• A notice that bank details have changed, especially to an account in another country or bank.
• Urgency, pressure and a request not to call or not to tell anyone.
• Tone, language or signature slightly different from usual.
• The sender or reply address does not match the real supplier's when you look closely.
• The invoice PDF looks normal, but the payment details are different.
• A request to skip your normal approval process.

Company rule: confirm bank account changes by phone

The most effective protection is a simple written rule that everyone follows, including management: every bank account change is confirmed by calling the supplier on a number you already have (contract, earlier invoice, the supplier's website), never on a number given in the same e-mail.

1. The first payment to a new payee or changed account needs a second person's approval (four-eyes principle).
2. An unexpected payment request from a manager is confirmed through another channel: phone, Teams or in person.
3. Staff know they will never be blamed for checking, even if it delays a payment.

If the money has already been sent

1. Call your bank immediately and ask them to recall the payment or block the recipient account. Hours matter: the sooner the bank acts, the better the chance of recovery.
2. File a police report via politsei.ee or at a police service office. Call 112 only in an emergency; a fraud that has already happened usually is not one.
3. Preserve evidence. Do not delete the e-mails. Save the fraudulent message with its headers, the invoice and the payment order.
4. Check the mailbox. Attackers often add rules that hide or forward messages. In Outlook: Settings → Mail → Rules and Settings → Mail → Forwarding. An administrator can review sign-ins in the Microsoft Entra admin center (Sign-in logs).
5. Change the password and turn on MFA if you suspect your own mailbox was compromised. Sign the account out of all sessions.
6. Inform the supplier on a number you know. If their mailbox was hacked, other customers are receiving fraudulent e-mails too. Incidents can also be reported to CERT-EE (Estonian Information System Authority).

Prevention

• Multi-factor authentication (MFA) on every user account. Most mailbox takeovers start with a stolen password.
• SPF, DKIM and DMARC for your domain. They stop others from sending mail in your domain's name and help recipients detect forgeries.
• External sender tag. Exchange Online can mark messages from outside your organisation (Set-ExternalInOutlook -Enabled $true), making a fake "CEO e-mail" easier to spot.
• Mailbox audit. Regularly check that no one has external forwarding rules, and keep automatic forwarding to external addresses disabled.
• Training. A short session with real examples for accounting and management helps more than a long security policy.

When to call a professional

If money has gone or you suspect a mailbox has been taken over, get help straight away. A specialist can review sign-ins and rules and close the attacker's access. ITABIKS can also help set up MFA and DMARC as part of Microsoft 365 administration, phone +372 53 888 229.