In this guide · 8 sections
- 01How fake supplier invoice scams work
- 02Supplier bank detail changes: the one control that matters most
- 03Checks on every invoice before you pay
- 04Where InvoiceNow helps, and where it does not
- 05Email controls that cut fake invoices
- 06Paid a fake invoice? What to do in the first hour
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Never change a supplier's bank details because of an email or a PDF. Call the supplier on a number already on file, get a second person to approve the change, and hold the first payment until it is confirmed. If you have already paid, call your bank's anti-scam hotline immediately, then file a police report.
How fake supplier invoice scams work
There are three common patterns. Each one gets past someone who is checking the look of the invoice, because the invoice looks right.
| Pattern | What happens | Why it works |
|---|---|---|
| Edited real invoice | An attacker inside the supplier's (or your) mailbox changes the bank details on a genuine PDF and sends it on | Amount, invoice number and wording are all correct |
| Look-alike sender | A new domain one letter off the supplier's sends a "we have changed banks" letter | Busy staff read the display name, not the address |
| Invented invoice | An invoice for a plausible service (domain renewal, listing, maintenance) from a company you never hired | It is small and looks routine, so nobody questions it |
The first pattern often starts with a hacked email account. Our guide on what to do when business email is hacked covers the hidden forwarding rules attackers leave behind to read invoice threads.
Supplier bank detail changes: the one control that matters most
Put the rule in writing and apply it to every supplier, every time, whatever the amount and whoever asks. Our guide to scam safeguards for business bank accounts covers the matching bank settings, such as maker-checker approval.
Treat every bank-detail change as high risk
A letter, email or new PDF with different bank details is a request, not an instruction. Do not update the supplier record yet.
Call back on a number you already have
Use the number in your supplier file, on a past contract or on the supplier's official website you typed yourself. Never use a number, link or contact in the message asking for the change.
Confirm with someone you know
Ask your usual contact to confirm the old and new account number and the reason for the change. Write down who you spoke to, when, and on which number.
Second person approves the change
The person who updates supplier master data should not be the person who approves payments to it. In a two-person office, the owner signs off.
Hold or test the first payment
Pay the first invoice to new details only after confirmation. Some teams send a small amount first and ask the supplier to confirm receipt.
Tell the old contact by a separate channel
Let the supplier know a change request came in. If they did not send it, they may have a hacked mailbox.
Checks on every invoice before you pay
Beyond bank changes, a short routine catches invented invoices and duplicates. It works best when it is part of how payments are prepared, not an extra step someone remembers.
Before payment
Keep bank details in your accounting software's supplier record and pay from that record. If the PDF and the record disagree, the record wins until the call-back is done.
Where InvoiceNow helps, and where it does not
InvoiceNow is Singapore's e-invoicing network, run by IMDA on the international Peppol standard. Invoices travel as structured data from the supplier's software to yours, through accredited access points, addressed to each business's registered Peppol ID. There is no PDF attachment to intercept and edit on the way.
That makes the edited-PDF pattern much harder for invoices that arrive through InvoiceNow. It does not fix everything. If a supplier's own accounting system is compromised, or someone emails you a PDF "because InvoiceNow is down", you are back to the call-back rule.
IRAS is also phasing in the GST InvoiceNow requirement, which needs GST-registered businesses to send invoice data through the network, with dates up to April 2031 (IRAS). Our InvoiceNow (Peppol) set-up guide explains who must comply and when.
Email controls that cut fake invoices
Process controls do the heavy lifting, but your email system can remove many attempts before anyone sees them.
- External sender banner: a tag on mail from outside your organisation, so a look-alike "director" email stands out.
- Impersonation protection: Microsoft Defender for Office 365 and Google Workspace can flag mail that imitates your executives or regular suppliers' domains.
- MFA on every mailbox: most edited-invoice cases start with a mailbox taken over with a stolen password.
- Alerts on new forwarding rules: a forwarding rule to an outside address is a classic sign of a hacked account.
- DMARC on your own domain: makes it harder for others to send email that pretends to be from you.
Staff should still know the patterns. Our guide to spotting a phishing email covers the signs, and the payment-change rule above is the part to repeat in training.
Paid a fake invoice? What to do in the first hour
Speed matters more than anything else here. The ScamShield "I've been scammed" page lists the order: contact your bank, file a police report, secure accounts and inform contacts.
- Call your bank's anti-scam hotline now and ask it to try to stop or recall the transfer. Have the date, amount and receiving account ready.
- File a police report online or at a Neighbourhood Police Centre. Your bank and insurer will usually ask for the report number.
- Tell the real supplier by phone. Their mailbox, or yours, may be compromised.
- Check your own mailbox for forwarding rules and unknown sign-ins if the fake invoice came through your systems.
- Keep the evidence: the email with full headers, the PDF and the payment confirmation.
ScamShield warns that scam money is moved quickly between accounts, often overseas, and that the chance of recovery once funds leave Singapore is very low. That is why prevention matters more than recovery. If the email came from a hacked account that held customer data, also assess whether it is a PDPA data breach.
Do it yourself or get help?
The call-back rule and two-person approval cost nothing and can start today: write them down, tell the team and your suppliers, and update your supplier form. That alone stops most of these scams.
If you want the technical layer done for you, our Email Threat Protection (S$290) tunes Microsoft 365 or Google Workspace protection, turns on impersonation protection for directors and finance staff, adds external sender banners and sets rules that catch payment-change and gift-card scams. Security Awareness Training (S$390) sets up short monthly lessons with Singapore scam topics and completion tracking.
Frequently asked questions
Often you cannot tell by looking, because many fake invoices are real invoices with edited bank details. Check the sender address exactly, match bank details against your supplier record, confirm there is an order behind it, and call the supplier on a known number before paying any new or changed bank account.
Do not update anything yet. Call the supplier on a phone number you already have on file, not one in the email, and confirm the change with your usual contact. Have a second person approve the change in your system, and pay the first invoice to the new account only after confirmation.
Sometimes, if you act quickly. Call your bank's anti-scam hotline at once to try to stop or recall the transfer, then file a police report. ScamShield warns that money moved overseas is very hard to recover, so the first minutes and hours matter most.
It reduces one common route. InvoiceNow sends invoices as structured data between registered Peppol IDs through accredited access points, so there is no PDF to intercept and edit on the way. It does not stop fraud from a compromised supplier system or a PDF sent by email outside the network, so keep the call-back rule.
It depends on your contracts, your bank's terms and the facts, so ask a lawyer or your bank. In practice, if your own staff authorised the payment, banks usually treat it as an authorised transfer, and recovery depends on how fast the receiving account can be frozen. Prevention through verification is far more reliable.