Invoice redirection fraud is a payment scam in which an attacker convinces a business to send money to a false bank account by changing supplier payment details, often by posing as a trusted vendor or employee. The goal is to redirect an otherwise legitimate invoice payment before it reaches the real recipient.
This matters because the scam targets business workflows, not just systems. Attackers use leaked accounting data, invoice context, supplier names, and routine payment timing to make fake change requests look normal. Common signs include urgent IBAN update emails, last-minute bank detail changes, and pressure to bypass review. Defenses include call-back verification using known contact details, maker-checker or dual authorization for payment changes, and strict handling of any request that changes beneficiary information.