September 6, 2026 · by David Gilbert · 3 min read · Cyber Security
A client nearly paid a fake invoice recently that, at a casual glance, looked exactly like a genuine one from a regular, trusted supplier — correct logo, plausible amount, familiar-looking layout. It's one of the more common scams I see hit small businesses, and walking through exactly what gave this specific one away is more useful than another generic, abstract warning.
How It Actually Arrived
An email, apparently from the regular supplier's actual accounts contact, referencing a real, ongoing business relationship, with an attached invoice for an amount that wasn't dramatic or implausible enough to immediately raise suspicion on its own. Nothing about the initial framing screamed "scam" at first glance — that's exactly the point of how these are deliberately constructed to look unremarkable.
The First Small Tell
The bank account details on the invoice were subtly different from the ones this specific supplier had used on every previous invoice. Easy to miss if you're not specifically cross-checking against a previous invoice side by side, which, completely understandably, almost nobody routinely does for a regular, trusted, ongoing supplier relationship.
The Second, More Telling Sign
The email address was extremely close to the genuine one — one subtly altered character, the kind of thing that sails straight past a quick glance and is specifically, deliberately designed to do exactly that. Scammers frequently register lookalike domains for precisely this purpose, banking on nobody examining an email address closely enough, character by character, under normal everyday time pressure.
What Actually Caught It This Time
My client's bookkeeper had a genuinely good habit of cross-checking any changed bank details against a previous invoice before processing payment, every single time, treated as a completely routine, non-negotiable step rather than an occasional, optional precaution. That one specific habit, applied consistently and without exception, is what caught this particular scam before any money actually moved.
Why This Specific Scam Works So Well Generally
It exploits an existing, genuine trust relationship rather than trying to build a fake one entirely from scratch, which is exactly why it's so much more effective than an obviously cold, unsolicited scam attempt. You already trust this supplier. The scam simply, quietly inserts itself into that pre-existing trust at exactly the one specific, vulnerable point — the bank account details — where a meaningful financial outcome actually changes hands.
What I Now Recommend to Every Client
- Any changed bank details, on any invoice, from anyone, ever — verified through a separate channel, every single time, no matter how minor or routine the change appears, and no matter how well-established and trusted the relationship is.
- A second person reviewing any payment above an agreed threshold, so a single person under time pressure isn't the entire, sole line of defence against this kind of scam.
- A standing habit of comparing new invoices against a previous one from the same supplier, specifically checking the actual account details, not just the total amount or the general appearance.
The Honest Reality of This Scam Category
This isn't a rare, exotic attack — it's depressingly common, and it specifically targets the everyday routine of paying invoices, which is exactly the kind of task that's most likely to be done quickly, under real time pressure, without a second, more careful look. The defence isn't fundamentally clever or technical. It's a simple, boring, consistent habit, applied every single time without exception — which, as with so much of cyber security, turns out to be the actual answer far more often than people expect or hope it will be.