The payment that should never have gone out
Invoice fraud does not look like fraud. It looks like a supplier you know, with an invoice you were expecting, and one changed line: the bank account.
How it works today
An email arrives from a familiar supplier: new bank details, please use them from now on. The invoice that follows looks exactly like the previous ones. It gets approved, it goes into the payment run, and it is gone.
The variants are endless: a domain one letter different, a reply that hangs under a real conversation, an urgent request outside office hours from someone who appears to be the director.
What these have in common is that they pass a human check. Not because people are careless, but because the check is a glance at a name, and the name is right.
- Supplier invoices paid in batches
- More than one person able to approve payments
- Suppliers who occasionally do change bank details legitimately
- A payment run nobody checks line by line
What happens, step by step
- 1Establish the supplier, not recognise them
The match runs on the registration number and the bank account, not on the name above the invoice. A name is what a fraudster controls; a bank account is what they have to change.
- 2Compare against the history
A bank account that has never been used for this supplier is an exception by definition, however normal the rest of the invoice looks.
- 3Flag lookalike domains
A sending domain that differs from the known one by one character is flagged, including the classic swaps that read the same at a glance.
- 4Recognise urgency as a signal
Wording that pushes for speed, outside office hours or outside the usual route, raises the threshold instead of lowering it.
- 5Check amount and pattern
An amount that falls outside what this supplier normally invoices is presented, not passed on.
- 6Stop, then ask
A flagged invoice does not go into the payment run. It goes to a person, with the reason it was stopped stated.
Where it goes wrong when it is built too simply
These are the questions we ask in the quick scan. If a supplier does not ask them, they surface later anyway — usually once there is already an invoice.
- A supplier who genuinely does change bank details, and rightly gets annoyed at being doubted.
- A takeover: same company, new legal entity, new registration number, new account.
- A first invoice from a new supplier, where there is no history to compare against.
- An invoice approved by someone with authority who is themselves being misled.
- A factoring company that legitimately collects on behalf of a supplier.
- Payment terms that are so tight the check itself becomes the delay.
What it delivers
The rule of thumb in this area is unforgiving: money that has gone out is rarely recovered. A check that stops one payment a year has usually paid for the whole automation.
Just as valuable is that it stops being personal. Nobody has to feel foolish for almost falling for it, because the system flags it rather than a colleague.
This is not a guarantee. It raises the threshold and makes the exception visible; the decision stays with a person, and that is deliberate.
Build: €1,750 – €4,500
Category: Standard automation
Build time: 18 to 34 hours
Lead time: 2 to 4 weeks
Maintenance: Care, €195 per month
A range, not a quote. What it becomes for you follows from the Automation Check. All prices →
See all prices →Start with one process
Tell us which work gets retyped most often at your company. If automating it turns out to be a bad idea, you will hear that in the first conversation — before there is an invoice.
The first conversation is free and without obligation. Want it substantiated? The Automation Check is €295 — deducted if you have us build within 30 days.