Ilia Zavialov on the invoice that arrives with one line changed

01

How the substitution reaches a small team

The starting point is reading access to a mailbox on one side of the conversation. It may come from a password reused on a service breached years ago, from a copied sign-in page or from a session token taken out of a browser. For a while nothing visible happens, because the intruder is reading. Within weeks they know who approves payments and on which days money moves.

The substituted invoice arrives when a payment is genuinely due. Sometimes it comes from a look-alike domain with one character changed, sometimes from the real mailbox with the earlier thread quoted underneath. A quiet rule inside the compromised account often diverts the supplier messages into a folder nobody opens, so the original never surfaces to contradict the forgery.

What the finance person sees is entirely ordinary. A familiar thread, a familiar name, an amount matching the contract and a short apology about a change of banking arrangements. In a company of five the same person reads, decides and pays within minutes.

The attack aims at the seam between people. Once the mailbox is open, the rest requires no unusual technical skill. It works because the payment routine of most small teams treats the thread itself as proof of identity, and the thread is the part that has already fallen.

02

Why the bank details line is the field nobody remembers

Every other field on an invoice has a memory attached to it. The amount is remembered from the quotation, the dates from the contract, the description from work actually delivered. An account number carries no memory at all. Nobody in a team could recite a supplier account number from recall, so an altered line produces no feeling of wrongness.

Some payment systems compare the payee name against the account holder before a transfer leaves. That comparison catches typing mistakes and careless copying. It is weaker against a party who opened the receiving account under a name close to the invoice. The check narrows the attack while leaving it open.

Behind the failure sits an asymmetry of effort. Verifying a change costs a phone call, a few minutes and a little social awkwardness. Skipping the check costs nothing visible on the day it is skipped. Teams optimise for visible cost, and the design of the attack counts on that.

For that reason the check belongs in the written payment procedure. A step living in the procedure survives a busy afternoon and a new hire. A step that depends on somebody feeling suspicious lasts until the first entirely ordinary day.

03

What the reported figures carry, and what they leave out

For 2025 the FBI Internet Crime Complaint Center logged 1,008,597 complaints and close to 21 billion dollars of reported losses, around 26 per cent more than the year before. Business email compromise accounted for 3.046 billion dollars, second only to investment fraud. Behind that figure sit individual transfers, each authorized by a person who believed the request was legitimate.

For a small company a single case matters more than the size of the category. One transfer against a forged invoice is often the largest payment of that month, and a firm with a thin cash buffer feels it in payroll within days. Recovery, where it happens at all, is decided in the first hours.

The same annual report introduced a marker for cases connected to artificial intelligence for the first time. More than 22,000 complaints and roughly 900 million dollars of losses carried it. Placed beside the total, that marker looks modest, and the impression is misleading.

The gap shows most clearly in the investment category. Out of more than eight billion dollars of investment losses, only 632 million carried the artificial intelligence marker. The marker records what a victim noticed and could describe, so it counts recognized synthetic material only. Any figure about cloned voices is a floor, and planning that treats it as a ceiling understates the exposure.

04

Where the approach actually arrives

Payment fraud data from the United Kingdom shows where first contact happens. Among authorized push payment cases, 66 per cent begin online and a further 17 per cent start through telephone networks. The channels carrying the approach are the channels the business already uses for its work.

That closes off channel filtering as a defense for a small team. Invoices, delivery notes, contract drafts and shared document links land in the same inbox as the forged request. A separate finance address helps with sorting, and the message still looks like business correspondence, because it is business correspondence with one line altered.

Stronger versions of the scheme run two channels at once. A message prepares the ground and a call closes the decision, or a call warns of a document that then arrives on cue. Each channel is offered as evidence that the other is genuine, and the combination feels like verification while supplying none of it.

The conclusion for a procedure is narrow. The channel used for confirmation is chosen by the company in advance and drawn from its own records. Whenever the party making a request also supplies the means of confirming it, that confirmation carries no weight.

05

What a reply in the same thread proves

The instinctive response to a change of details is to reply and ask. If the mailbox is being read, the reassuring answer comes back within minutes, in the same thread, with the same signature and the same turn of phrase. The check has consumed time and produced a false all clear.

Replying to an address that looks new is no safer. A visible sender name can say anything, and a reply-to header can point somewhere else entirely, so a reply typed in a hurry may travel straight to the intruder. Message headers answer this question reliably, and almost nobody opens them at the moment of paying.

The underlying principle is short. A channel cannot verify itself. Confirmation carries weight only when it runs through an identity established before the message in question ever arrived.

This is why a register of counterparty contacts is built at contract signature and kept where the person paying can reach it in seconds. A number looked up at the payment moment usually comes from a signature block or a website, which may sit under the same control as the invoice. Such a register ages badly without maintenance, so the numbers are checked periodically.

06

Voice stopped being proof on its own

A convincing clone of a voice is built from a recording of about three seconds and reaches roughly 85 per cent accuracy. Recordings of that length exist for nearly everyone who works: a voice note in a group chat or a recorded webinar. Being unknown to the public offers no protection here.

Human hearing gives little help. In controlled testing, listeners separated a real voice from a synthetic one in 37.5 per cent of attempts, which sits below the result of guessing between two options. Confidence in recognising a colleague by voice comes from context, and context is what the caller supplies.

Volume followed the tooling. Vishing built on cloned voices grew by 1633 per cent in a single quarter, the shape of growth that appears when a technique becomes cheap to run. Cheap techniques reach ordinary suppliers and small companies quickly, and they stop requiring a specialist.

Two properties of a call survive all of this. The first is direction, because an outbound call to a stored number reaches the real person whoever is imitating them. The second is knowledge living outside the correspondence, because reproducing a voice has become easy while reproducing a detail that was never written down stays hard.

07

The control written as a step in the procedure

The rule fits into one sentence. Changed bank details take effect after a spoken confirmation on a number the company held before this conversation started. The person confirming names the invoice number and the amount without being prompted.

Three properties make it hold. Direction matters, because an incoming call carries whatever identity the caller chose to display. The source of the number matters, because a number taken from the letter belongs to the author of the letter. The content of the question matters, because a voice is easy to reproduce while an unwritten detail is hard to guess.

Where the rule lives decides whether it works. Attached to the payment step it becomes a field on the payment request, recording whether details changed, who confirmed, when and on which number. A control with a written trace can be audited later by an accountant or an owner, while a memo read once during induction leaves no trace.

The cost is one phone call per genuine change of details, a handful of calls a year in a small company. The rule holds only when it applies without exception, including to requests from the owner and to requests arriving with a deadline attached. Urgency is the standard packaging of the fraudulent version, so skipping the call for speed removes the control at the moment it is needed.

08

Roles, deputies and the second pair of eyes

A control that lives with one person stops working on the day that person is ill or on leave. The procedure therefore names two people for the payment role, the holder and the stand-in, and trains both on the same rule. The stand-in is where most small teams lose the control, because the substitute is usually senior and the most likely to hear that an exception is fine this once.

Separating two actions helps wherever headcount allows it. Whoever edits a payee record in the accounting system and whoever approves the transfer are different people, so a quiet edit cannot become a payment on its own. In a team of three the workable version is a second pair of eyes on new payees and on changed details above a threshold the company sets.

The owner carries a specific job here, which is to make the rule survive their own authority. Written approval that the rule covers the requests of the owner removes the most common lever, the appeal to seniority and haste. Without that line in writing, staff keep guessing about when caution is welcome.

External bookkeepers fall under the same procedure, written into the contract with them. A rule stopping at the company boundary leaves the payment button with somebody who never agreed to it. New staff meet the procedure in their first week, on a single written page.

09

The mailbox on your own side of the conversation

The compromised mailbox belongs to the supplier as readily as to the company itself, and from the outside the two situations look identical. Treating your own mail as a possible source of the next forged invoice changes what is worth doing. A second factor resistant to phishing closes the entry point that starts most of these cases, and it remains the single most useful setting available to a small team.

After the second factor comes the part that gets forgotten. Rules that forward mail outside the company or move messages from one sender into an unused folder are the standard footprint of a takeover, and reviewing them takes minutes. Sign-in records, connected applications and legacy protocols that bypass the second factor deserve the same periodic look, as does log retention long enough to reconstruct events.

Being the source has a commercial side. When a company mailbox is used to bill its own clients, those clients pay a stranger and the relationship absorbs the damage, whatever the legal position turns out to be. The same rule travels outward, stated in the contract and in the invoice footer: banking details never change by email alone, and the number to call is printed there.

10

The first hours after the money has gone

Reaction time decides the outcome. The first call goes to the company bank with a request to recall the payment, followed by a written notice to the receiving bank. Funds are moved onward through further accounts quickly, and the practical window is measured in hours. A payment noticed the same morning keeps chances the weekend removes.

Evidence is preserved before anyone tidies up. The original message is exported with full headers, because the headers show whether it came from the genuine mailbox or from a look-alike domain, and that difference decides whose systems failed. Deleting the message to avoid confusion is a common first instinct and destroys the only reliable record.

Reporting runs in parallel with recovery. The national reporting body and the police receive the case, and the counterparty hears immediately, because their mailbox may be the compromised one and other clients may be receiving the same invoices. A supplier who learns of it a week later has spent that week billing under a name they no longer control.

The review afterwards has one useful output, a changed step in the procedure that would have stopped this specific instance. Treating the person who paid as a witness keeps the account accurate, while treating them as the cause guarantees that the next attempt is reported late or never. A second forged invoice often follows while the mailbox is still open, which is why the review finishes quickly.