How invoice fraud catches out haulage and logistics firms

How a typical attack unfolds

The fraud rarely starts with your business. It usually starts with someone you pay. A subcontractor's email account is compromised, often through a convincing phishing email. The attacker then reads their correspondence quietly, sometimes for weeks, learning who they invoice, when and for how much.

At the right moment, typically just before a large payment run or month-end, a message arrives from the genuine email address. It says the bank details have changed and attaches a new invoice. Because the email is real, nothing looks wrong.

If the change is made from that email alone, the next payment goes to the criminal's account. It is often only discovered when the real supplier chases for payment, by which time the money has usually moved on.

Why the sector is exposed

• Large numbers of subcontractors and suppliers, often small businesses with limited security themselves
• Regular, high-value payments that make one more invoice easy to miss
• Pressure to pay quickly to keep good hauliers working with you
• Accounts teams who are busy and often working from email alone
• Shared mailboxes for invoices and remittances that many people can access

Five controls that stop it

None of these require expensive technology. They are process controls, and they work.

• Verify every bank-detail change by phone, using a number you already hold, never one from the email or invoice.
• Require a second person to approve any change to supplier bank details, separate from the person who processes payments.
• Treat urgency as a warning sign. A request to pay a new account quickly should slow you down, not speed you up.
• Send a small test payment to new bank details and confirm receipt with the supplier before paying the full amount.
• Protect your own email with multi-factor authentication, so fraudsters cannot use your mailbox to target your customers.

If you think a payment has gone to the wrong account, contact your bank immediately. The sooner they know, the better the chance of stopping or recovering the funds. Then report it to Report Fraud, the UK's national fraud and cyber crime reporting service.

Where to start

Look at how bank-detail changes were handled over the last three months. Who received the request, who made the change and how was it verified? The answer usually tells you very quickly whether you are exposed.

Our free supplier bank-detail fraud checklist sets out the controls in a form your accounts team can use straight away.