How to stop fake invoice and "new bank account" fraud

By the FarSec team · Updated 2026-11-06

How the fraud works

The pattern is nearly always the same, whether the target is a factory in Faisalabad, a hospital in Lahore or a software house in Karachi:

1. The criminal learns who pays whom. Sometimes from a hacked mailbox (a supplier's or yours), sometimes just from public information: your website, LinkedIn, tender notices.
2. A convincing email arrives. It looks like it comes from a real supplier or from your own director. It often replies inside a real email thread, uses the right invoice numbers and arrives near a real payment date.
3. The request is small and urgent. "Our bank account has changed, please use the new details for this payment", or "I'm in a meeting, release this payment today and I'll explain later."
4. Your team pays. By the time the real supplier asks where their money is, the funds have moved on. Recovery is hard after the first day.

Warning signs your accounts team should know

• Any request to change bank details, especially by email only.
• Pressure: "urgent", "confidential", "don't call, I'm travelling".
• A sender address that is almost right: supp1ier.com.pk, company-pk.com, a Gmail address with the right display name.
• A reply-to address different from the sender.
• A new account in a different bank, city or name than before.
• An invoice PDF that looks slightly different from the supplier's usual one.

The one-page payment-verification policy

Print this, sign it as management, and give it to everyone who can release payments.

1. Bank details never change by email alone. Any new or changed account is confirmed by a phone call to the supplier on a number already in our records, never a number from the email asking for the change.
2. Two people for every new payee. One person enters a new or changed account, a second person approves it.
3. Hold the first payment. The first payment to changed details waits one working day after the call-back, unless a director approves in writing.
4. No exceptions for seniority. An urgent payment request from the CEO or a director is verified the same way. Leadership agrees in advance that staff who check are doing their job.
5. Report, don't delete. Suspicious requests are forwarded to IT or management, even if nobody paid.

The technical side: stop fakes of your own domain

Criminals prefer to send from your real domain or your supplier's, because it passes the eye test. Three free DNS records (SPF, DKIM and DMARC) let Gmail and Outlook reject those fakes. In November 2026 we looked at the public email settings of about 70 Pakistani organisations and nearly two in three had no DMARC record or a monitor-only one. Our DMARC setup guide walks through it for Microsoft 365, Google Workspace and cPanel.

Also protect the mailboxes themselves:

• Multi-factor authentication on every mailbox, starting with directors and accounts staff. See our Microsoft 365 security checklist.
• Check mailbox forwarding rules once a month. Attackers who get into a mailbox often add a hidden rule that copies or hides invoice emails.
• Mark external email with an "External" banner so a fake "director" email from outside stands out.

If you have already paid

1. Call your bank's fraud or complaints line immediately and ask them to contact the receiving bank to freeze or recall the funds. Hours matter.
2. Keep the emails with full headers. Don't delete anything.
3. Change the passwords of any mailbox that may be involved and check its forwarding rules.
4. Tell the real supplier or client by phone, so their side can check for a compromise too.
5. File a complaint with the national cybercrime authority and keep the reference number for the bank.

Free check for Pakistani businesses

Send your domain to [email protected] and we will reply with a free one-page check of your email protection (SPF, DKIM, DMARC) and website basics. We use public information only; nothing is tested without your written permission.