Free resource · for finance & CA teams

Vendor invoice fraud: the AP checklist

A known supplier emails to say their bank details have changed, right before a payment run. This is business email compromise (BEC) — India's most common invoice fraud. It does not need malware; it needs a busy AP clerk trusting an email under time pressure.

Red flags on a "bank details changed" email

New account, supplied by email

A request to update a vendor's bank details, with a new account number, IFSC or UPI — timed near a real invoice so it reads as routine.

Free-webmail or lookalike sender

It comes from Gmail/Outlook/Yahoo instead of the vendor's business domain, or a lookalike (acme-corp.co vs acmecorp.com) that reads right at a glance.

Urgency and secrecy

"Process before end of day." "Keep this between us." The pressure exists to stop you calling the vendor to verify.

A reply inside a real thread

The most convincing version replies within a genuine email thread from a compromised mailbox. Everything above the change request is real — which is why the change must be verified another way.

The control that stops it

One habit defeats almost every invoice-redirection attempt. Make it a rule, not a judgement call:

Never change a vendor's bank details from an email alone. Treat every change as unverified until a person confirms it.
Call back on a number you already hold — from a past invoice or your master data — not the number in the new email or its signature. Confirm the change verbally.
Require dual authorisation for any change to standing payment details, separate from the person who processes the payment.
Check the sender domain matches the vendor's usual business domain exactly — not a free-mail account or a one-letter lookalike.
Hold the payment if anything is off, and report it on cybercrime.gov.in or via 1930. A held payment can be recovered; a sent one rarely can.

Not sure about a specific email? Paste it into the free vendor invoice fraud checker — it flags these signals in seconds, in your browser.

Add ScamShield AI to your practice.

CA firms use ScamShield AI to protect every SME client from one dashboard — flagging payment-change requests, lookalike senders and vendor fraud before a client acts on them. Ask about the CA Partnership programme: partner pricing, and clients onboarded under your own dashboard.

Explore the CA Partnership Talk to us about partnering