How to stop invoice and payment-change scams in email

An invoice can arrive in a message that looks familiar and still deserve a careful check. The FBI's business email compromise guidance describes criminals impersonating trusted contacts, using slightly altered addresses and gaining access to legitimate billing conversations. A familiar name or conversation is not enough to approve a payment.

For a small business or nonprofit, the most useful starting point is a repeatable payment process. Decide who can request changes, who checks them and who releases funds. Write the steps down so a colleague covering leave can follow the same process. The recommendations below combine independent verification with email controls; none should be treated as a guarantee.

Confirm bank-detail changes outside email

The FBI recommends verifying changes to account numbers or payment procedures with the person making the request. It advises calling to verify payment requests and finding the company's number independently, rather than using a number supplied by a potential scammer. Use a known number from your established supplier records, not the new invoice or suspicious message.

Pause the change until that check is complete. Ask the known contact to confirm the requested details, then record who verified them and when. Consider requiring a second authorized person to approve changes to payment records. Make that a normal control, not a judgment about whether a particular colleague or supplier seems trustworthy.

Do not let urgency replace verification. The FBI specifically warns about pressure to act quickly. Agree an escalation contact for urgent requests, including requests apparently coming from a director or senior manager. Staff should be able to pause a payment without being blamed for following the agreed process.

Read the address, not just the name

The FBI advises checking email addresses, URLs and spelling carefully because scammers use small variations to appear authentic. Expand the sender details and compare the full address and domain with your supplier record. Look for an extra letter, a substituted character or an unexpected domain instead of relying on the display name.

A mismatch is a reason to investigate, but an address that looks correct should not cancel the phone check. The same FBI guidance describes attackers accessing genuine email threads. Keep the independent check for every bank-detail change, even when the request appears in an ongoing conversation.

Use DMARC as a domain control

Google's DMARC setup guidance explains that DMARC checks whether the visible From domain aligns with a domain authenticated through SPF or DKIM. Its policy tells receiving systems how to handle authentication failures. A monitoring policy, p=none, does not request blocking; quarantine and reject request stronger handling.

Google recommends setting up SPF and DKIM before DMARC and beginning with monitoring, then moving toward enforcement as you understand legitimate sending. Ask your IT provider to review all services sending for your domain before changing policy. Treat authentication as evidence about a domain, not approval of an invoice: keep the FBI's independent payment verification step even when a message passes checks.

Investigate unexpected forwarding rules

Microsoft lists rules forwarding mail to unknown addresses, rules hiding messages in other folders and newly added external forwarding among signs of a compromised mailbox. Ask your administrator to review unexpected changes, especially when payment conversations go missing or colleagues report messages you did not send.

Report the rule and preserve the details for the investigation; do not assume removing one rule resolves the incident. Microsoft's response guidance covers securing the account and reviewing forwarding and inbox rules. It also recommends enforcing multifactor authentication. Have your administrator follow the appropriate response process rather than improvising from the suspicious message.

Act promptly if money was sent

The FBI advises contacting your financial institution immediately and asking it to contact the institution that received the transfer. It also directs victims to report business email compromise to IC3. Notify your internal incident contact and retain the request, payment details and verification records. Do not assume recovery is guaranteed.

Use these checks alongside technical controls and a clear reporting process. To review KnoxDefender's capabilities and distinguish available services from integrations still in provider verification, see email protection and security features.