The Invoice Was Real, but the Bank Details Changed: How to Investigate Supplier Impersonation and Payment Redirection
The invoice arrives from a familiar supplier. The company name is correct, the purchase order matches an existing project and the amount appears consistent with previous payments.
But one detail has changed: the bank account.
The email explains that the supplier has updated its payment information and asks the recipient to use the new details for the outstanding invoice. The message may look professional, arrive within an existing email conversation and contain documents that appear genuine.
The payment is processed.
Only later does the business discover that the money was sent to an account that did not belong to the supplier.
This type of fraud is commonly associated with supplier impersonation, payment redirection and business email compromise (BEC). It can involve a compromised supplier mailbox, a fraudulent email account, manipulated invoice documents or an attacker who has been monitoring business communications.
The challenge is that the underlying business transaction may be entirely genuine. The supplier exists, the work was completed and the invoice may be authentic. The fraudulent element is the payment instruction.
Investigating the incident means reconstructing how the bank details changed, who communicated the new instructions, whether an email account was compromised and where the payment went.
This guide explains how to investigate supplier impersonation, preserve financial and email evidence, identify payment redirection and build a clear record of what happened.
1. Understand How Supplier Payment Redirection Happens
Supplier payment redirection occurs when a business is persuaded to send money to a bank account controlled by someone other than the intended recipient.
An attacker may impersonate a supplier or compromise a genuine business email account to introduce fraudulent payment instructions.
Common scenarios include:
- A supplier email account is compromised.
- An attacker creates an email address resembling the supplier’s domain.
- A genuine invoice is modified to display different bank details.
- A fraudulent message is inserted into an existing conversation.
- A payment change is requested shortly before an invoice becomes due.
- An attacker impersonates a supplier’s finance department by telephone.
- A legitimate mailbox is used to monitor conversations before sending fraudulent instructions.
The timing can make the fraud difficult to detect. A request to change bank details may arrive just as a business is preparing a payment, leaving little time for careful verification.
The investigation should establish whether the payment instruction came from the legitimate supplier, an impersonator or an account that may have been compromised.
2. Preserve the Original Invoice and Payment Instructions
Start by collecting the documents associated with the transaction.
Do not rely exclusively on printed copies or screenshots. Preserve original digital files and emails wherever possible.
Relevant evidence includes:
- Original supplier invoice.
- Updated or replacement invoice.
- Purchase order.
- Contract or service agreement.
- Original payment instructions.
- Email requesting the bank-detail change.
- Previous supplier communications.
- Payment confirmation.
- Bank beneficiary information.
- Internal approval records.
- Correspondence after the discrepancy was discovered.
Compare the original invoice with the replacement document.
Look for differences in:
- Account holder name.
- Bank name.
- Account number.
- Sort code or routing number.
- IBAN.
- SWIFT/BIC.
- Payment reference.
- Invoice number.
- Document metadata.
- Creation and modification timestamps.
A changed account number is important, but it is not the only possible indication of document manipulation. An invoice may also be genuine while the email containing it is fraudulent.
Preserve both the document and the message through which it was delivered.
3. Investigate Who Requested the Change
One of the central questions is who actually sent the new payment instructions.
Start by identifying the communication channel used to request the change.
Was it:
- An email from the supplier?
- A reply within an existing conversation?
- A new message from a similar-looking address?
- A telephone call?
- A messaging application?
- A document-sharing notification?
If the request arrived by email, preserve the original message and examine its headers.
Important details include:
- From address.
- Reply-To address.
- Return-Path.
- Message-ID.
- Received headers.
- Authentication-Results.
- SPF, DKIM and DMARC results.
- Message timestamps.
- Embedded links and attachments.
A message from a genuine supplier mailbox may pass normal email authentication checks even if the mailbox has been compromised.
Therefore, passing authentication does not establish that the supplier’s authorised staff member sent the payment instructions.
Contact the supplier using a telephone number or communication channel already established before the incident. Do not use contact details supplied in the suspicious message to verify that same message.
4. Compare the Supplier’s Email Domain and Communication History
Supplier impersonation may involve a lookalike domain designed to resemble a genuine business address.
For example, an attacker may register a domain with a minor spelling difference or an additional word.
The difference can be difficult to notice when a message is viewed quickly on a mobile device.
Compare the suspicious sender address with previous legitimate communications.
Examine:
- The exact domain spelling.
- Subdomain structure.
- Display name.
- Reply-To address.
- Signature information.
- Previous email threads.
- Known supplier contacts.
- Website and company contact details.
Also consider whether the message was sent from the supplier’s actual domain.
If it was, investigate the possibility of mailbox compromise. Review available authentication logs, suspicious sign-ins, forwarding rules and connected applications.
For further guidance on examining suspicious communications, see Cyb3rsect’s Email Forensics resources.
5. Investigate Whether the Supplier’s Mailbox Was Compromised
A compromised supplier account can give an attacker access to information that makes payment fraud much more convincing.
The attacker may be able to read:
- Previous invoices.
- Purchase orders.
- Payment schedules.
- Customer names.
- Supplier contact details.
- Bank information.
- Ongoing negotiations.
- Internal email conversations.
This information can help an attacker choose the right moment to send fraudulent instructions.
If the supplier confirms that it did not request the change, ask its authorised IT or security team to investigate the mailbox.
Depending on the email system, relevant records may include:
- Sign-in history.
- Unrecognised devices.
- Unusual IP addresses.
- Password-reset activity.
- Multifactor authentication events.
- New mailbox forwarding rules.
- Delegated mailbox access.
- Connected applications.
- Unusual sent-mail activity.
- Changes to account recovery details.
The recipient organisation should also examine its own mailbox and communication records. The fraudulent instruction may have been sent from a compromised account on either side of the transaction.
Do not assume the supplier was responsible simply because its name appeared in the email.
6. Examine Whether an Existing Email Conversation Was Manipulated
Some payment redirection incidents involve messages that appear to continue a genuine conversation.
An attacker may have access to a mailbox and monitor an ongoing exchange. They can then send a message at an appropriate point, using the existing subject line and business context.
This may create the impression that the new instructions are part of a legitimate discussion.
Preserve the entire conversation rather than examining only the message containing the changed bank details.
Compare:
- Message IDs.
- Sender and recipient addresses.
- Message timestamps.
- Reply chains.
- Attachments.
- Email headers.
- Changes in writing style.
- Unusual requests.
- Unexpected changes in contact information.
A difference in writing style can be worth noting, but it is not proof of impersonation. People write differently depending on the situation, device or time available.
The strongest conclusions come from multiple supporting records.
7. Examine the Replacement Invoice for Signs of Manipulation
A fraudulent payment request may arrive with an invoice that looks almost identical to the original.
The document may contain the supplier’s branding, logo, address and invoice reference. Only the payment information may have changed.
Compare the original and replacement files at the document level where possible.
Potential areas of examination include:
- Document creation and modification dates.
- Author and software metadata.
- Embedded images.
- Text changes.
- Page layout differences.
- PDF properties.
- File hashes.
- Embedded links.
- Bank information displayed in the document.
PDF metadata may provide useful clues, but it can be changed and should not be treated as conclusive proof of authorship.
A file’s hash value can help establish whether two copies are identical. If their hashes differ, the files are not identical, but this alone does not prove that a fraudulent alteration occurred.
Preserve both versions so that a meaningful comparison can be conducted.
8. Reconstruct the Payment Process
The payment itself is a separate evidence source.
Establish exactly how the transfer was requested, approved and processed.
Record:
- Payment amount and currency.
- Payment date and time.
- Beneficiary name.
- Beneficiary account details.
- Bank or payment provider.
- Payment reference.
- Transaction identifier.
- Approval records.
- Staff involved in the process.
- Verification steps performed.
Compare the actual beneficiary details with the supplier’s previously verified banking information.
If the organisation used an approval system, examine the relevant audit trail. This may show who entered the beneficiary, who approved the transfer and whether any controls were bypassed.
The investigation should distinguish between the person who requested the payment change, the person who entered the new details and the person who authorised the transfer.
These may be different individuals.
9. Follow Up With the Bank or Payment Provider Immediately
If funds have been sent to an unauthorised account, time matters.
Contact the sending bank or payment provider using its official contact details.
Explain that the payment may have resulted from supplier impersonation or fraudulent payment instructions.
Ask what options are available for:
- Attempting a payment recall.
- Requesting an urgent beneficiary-bank notification.
- Reporting suspected fraud.
- Preserving transaction records.
- Obtaining a formal case reference.
- Providing supporting documentation.
A payment recall or recovery is not guaranteed. The available options depend on the payment method, financial institutions involved, jurisdiction and timing.
Preserve all communications with the bank, including case numbers, timestamps and instructions received.
Do not delay reporting while trying to complete every part of the investigation yourself.
10. Investigate the Beneficiary Account and Payment Destination
The destination of the funds may provide important investigative information.
Collect the beneficiary information recorded by the bank and any transaction identifiers available.
For international transfers, preserve the relevant IBAN, SWIFT/BIC and intermediary-bank details where provided.
For other payment methods, retain the corresponding transaction references.
An investigator may be able to examine available records to identify inconsistencies between the intended supplier and the actual beneficiary.
However, the account name, account number or payment destination does not automatically establish who controlled the account.
Access to banking records is restricted. Any request for further account-holder information must be made through appropriate legal, regulatory or financial-institution channels.
Avoid making unsupported claims about the identity of the recipient.
11. Check Whether Other Suppliers or Payments Were Targeted
Supplier payment fraud may affect more than one transaction.
If an attacker had access to a business mailbox or internal correspondence, they may have identified other suppliers, invoices or upcoming payments.
Review recent communications and beneficiary changes for similar patterns.
Look for:
- Other requests to change bank details.
- Unexpected replacement invoices.
- New beneficiary records.
- Similar email addresses.
- Repeated payment references.
- Unusual urgency.
- Multiple messages sent from the same suspicious account.
- Unexplained changes to supplier contact information.
Check whether any additional payments were made using altered instructions.
For organisations, review the affected supplier relationship and consider whether other employees or departments received similar messages.
12. Build a Timeline of the Supplier Impersonation Incident
A timeline helps connect the original business transaction, fraudulent communication and payment.
| Event | Evidence to preserve |
|---|---|
| Original supplier relationship | Contract and verified contact details |
| Original invoice issued | Original invoice and email |
| Suspicious payment change requested | Email, call records or message |
| Replacement invoice received | Original digital document |
| New beneficiary entered | Payment-system audit record |
| Payment approved | Approval history |
| Funds transferred | Bank confirmation and transaction reference |
| Fraud discovered | Internal reports and supplier confirmation |
| Bank notified | Case reference and correspondence |
| Investigation begins | Preserved evidence and incident notes |
Use original timestamps wherever possible. If a date or time is approximate, identify it as such.
This chronology can help determine when the payment instructions changed and whether there were opportunities to identify the discrepancy before the transfer.
13. What to Do If a Supplier’s Bank Details Suddenly Change
A sudden change to payment instructions should be independently verified, even when the request appears to come from a familiar supplier.
Businesses should consider the following steps:
- Stop the payment until the new details are verified.
- Contact the supplier using previously established contact information.
- Preserve the original email and invoice.
- Compare the new details with the supplier’s verified records.
- Review relevant mailbox and account security activity.
- Confirm the identity of the person requesting the change.
- Record who approved the new beneficiary.
- If money has already been sent, contact the bank immediately.
- Preserve payment and communication records.
- Review other invoices and supplier accounts for similar changes.
For future payments, use a documented bank-detail verification procedure. High-risk changes should require independent confirmation and appropriate approval rather than relying on email alone.
How Cyb3rsect Can Help Investigate Supplier Impersonation
Supplier payment redirection can involve email compromise, document manipulation, fraudulent websites, unauthorised account access and financial transaction evidence.
A proper investigation needs to connect these different sources rather than treating the changed invoice as an isolated document.
Cyb3rsect focuses on digital forensics, cyber investigations and online fraud intelligence.
Depending on the available evidence and agreed scope, an investigation may involve:
- Examining original supplier emails and message headers.
- Reviewing suspicious payment instructions.
- Comparing original and replacement invoices.
- Investigating available mailbox security records.
- Examining relevant account and communication activity.
- Reviewing payment records and beneficiary information.
- Building a chronological record of the incident.
- Identifying inconsistencies and investigative leads.
- Preparing a structured report of findings and limitations.
An investigation cannot guarantee that transferred funds will be recovered or that the identity of an account controller can be established from the available records.
The purpose is to clarify how the incident occurred, preserve relevant evidence and identify what can be supported by the available information.
For businesses dealing with suspected supplier impersonation, business email compromise or payment diversion, visit Cyb3rsect to learn more about digital investigations.
Final Thoughts
An invoice can be genuine while its payment instructions are fraudulent.
That distinction is central to supplier impersonation investigations. The supplier may exist, the goods may have been delivered and the invoice may be valid, but the bank details could have been changed by someone who gained access to a business email account or impersonated an authorised contact.
Preserve the original communications, compare invoice versions, examine the account activity and contact the bank promptly if a transfer has already occurred.
Most importantly, never treat an emailed bank-detail change as sufficient verification on its own.
The objective is to establish who requested the change, how it was communicated, which payment controls were involved and where the funds were sent.
For digital forensics, cyber investigations and online fraud intelligence, visit Cyb3rsect.
