The Bank Approved the Payment. The Business Never Authorized It: How Payment Workflow Hijacking Is Investigated
The invoice was genuine. The supplier was real. The finance employee followed the usual process. But the money went somewhere it was never supposed to go.
At 8:42 a.m., the finance department of a manufacturing company receives an email from a familiar supplier.
The message references an outstanding invoice and explains that the supplier has changed its banking arrangements.
The email looks professional.
It includes the correct invoice number, the supplier’s company name, and details about an ongoing contract.
The accounts payable employee updates the payment record.
A manager approves the invoice.
The bank processes the transfer.
Everything appears routine.
Three days later, the supplier contacts the company.
The payment has not arrived.
The finance department sends a copy of the transfer confirmation.
The supplier examines the banking details and responds:
“That isn’t our bank account.”
The money has already left the business.
The payment was authenticated through the company’s normal banking arrangements. Yet the intended supplier never authorized the account change, and the company never intended to pay the new recipient.
How could this happen?
This fictional scenario illustrates a real and financially significant category of cyber-enabled fraud: business email compromise, supplier impersonation, and payment workflow hijacking.
These attacks exploit the relationship between communication, accounting records, human approvals, and banking systems.
At Cyb3rsect, our digital investigation publications examine how electronic evidence can help organizations reconstruct suspected fraud, account compromise, and unauthorized financial activity.
This guide explains how payment diversion occurs, how investigators establish what happened, and what businesses can do to protect their financial workflows.
The Most Important Distinction: Authentication Is Not Authorization
A payment can pass a bank’s authentication requirements and still be the result of fraud.
Authentication establishes that the transaction was submitted using accepted credentials or verification methods.
Authorization, in the business context, involves whether the transaction was properly approved for its intended purpose and recipient.
These concepts overlap, but they are not identical.
Consider a finance employee who is authorized to pay a supplier.
The employee receives fraudulent instructions changing the supplier’s bank account.
The employee updates the record and submits the payment.
The bank processes an authenticated instruction.
But the underlying business decision was manipulated.
The financial institution may have processed the transaction exactly as instructed, while the business was deceived about where the money should go.
This is why payment fraud investigations must look beyond the final banking confirmation.
The Invoice Was Real. The Bank Details Were Not.
One reason supplier payment fraud can be convincing is that criminals may not need to fabricate an entire transaction.
The legitimate invoice already exists.
The goods or services may already have been delivered.
The company genuinely owes the supplier money.
The attacker only needs to interfere with the payment instructions.
A fraudulent message may claim that the supplier has changed banks, opened a new account, or reorganized its finance department.
If the business accepts the new details without independent verification, a legitimate debt can be paid to an unauthorized recipient.
The problem is not necessarily the invoice itself.
It is the integrity of the information used to complete the payment.
How Payment Workflow Hijacking Happens
Payment workflow hijacking describes situations in which an attacker manipulates part of the process used to prepare, approve, or execute payments.
The method varies.
Some attacks involve impersonating a supplier.
Others involve compromising an email account.
Some target accounting software or approval workflows.
The common objective is to redirect a legitimate payment or induce a new fraudulent transaction.
The attacker may seek to influence one or more stages:
Payment request → Supplier verification → Banking detail approval → Invoice authorization → Payment execution → Reconciliation
An organization can have strong controls at the final banking stage while remaining vulnerable earlier in the process.
The Email That Arrived at Exactly the Right Moment
A fraudulent supplier message can be particularly persuasive when it references a real invoice.
How might an attacker know those details?
There are several possibilities.
The information may have been exposed through a compromised mailbox.
It may have been obtained from a stolen document.
It may have appeared in previous communications.
Or the attacker may have gathered enough information to construct a convincing message.
Investigators should not automatically conclude that a supplier’s email account was hacked.
A realistic-looking message may originate from an impersonation domain or a forged sender identity.
Establishing the source requires examination of the available evidence.
Business Email Compromise: The Fraud Behind the Conversation
Business email compromise, commonly abbreviated BEC, involves deceptive use of business communications to facilitate fraud.
The attacker may impersonate an executive, supplier, employee, or other trusted contact.
In some incidents, the criminal gains unauthorized access to a genuine email account.
In others, the attacker uses a deceptive address or domain that resembles a legitimate one.
A compromised mailbox can be especially dangerous because the attacker may be able to observe existing conversations.
They may learn about invoices, payment deadlines, approval processes, and business relationships.
But the existence of a convincing fraudulent email is not proof that a mailbox was compromised.
Investigators should distinguish impersonation from confirmed unauthorized account access.
For related investigative methods, see Cyb3rsect’s Email Forensics guide.
The Supplier’s Name Matched. Why Didn’t Anyone Notice?
Many payment systems store suppliers as established vendors.
Once a supplier is approved, staff may assume subsequent invoices are routine.
An attacker can exploit that familiarity by presenting fraudulent banking details as a minor administrative update.
The supplier’s name remains unchanged.
The invoice number is correct.
The payment amount is expected.
Only the destination account changes.
If the approval process focuses primarily on the amount and invoice rather than the recipient’s bank details, the alteration may escape scrutiny.
That is why changes to beneficiary information should receive independent verification.
When the Accounting Platform Becomes Part of the Attack
Payment diversion is not always conducted entirely through email.
An accounting or enterprise resource planning platform may also be involved.
A compromised account with sufficient permissions could potentially modify supplier records or payment instructions.
Alternatively, an authorized employee may make a change after being deceived by a fraudulent message.
These scenarios can produce similar results.
A supplier record changes.
An invoice is approved.
A payment is submitted.
But the underlying cause differs.
Investigators need to determine whether the system was accessed without authorization or whether an authorized user was manipulated into making the change.
The Difference Between a Compromised Account and a Deceived Employee
These two situations are often confused.
Compromised account: An unauthorized party accesses a business account and performs actions using its permissions.
Deceived employee: A legitimate user performs an action because they believe fraudulent information.
Both can lead to unauthorized payments.
But they require different investigative conclusions and preventive controls.
A compromised account may require credential revocation, session review, and security remediation.
A deception-based incident may expose weaknesses in supplier verification and approval procedures.
Some incidents involve both.
What Investigators Need to Establish First
A payment diversion investigation should begin with the transaction and work backward.
The initial questions include:
- What payment was made?
- Which supplier was supposed to receive it?
- Which beneficiary account actually received the funds?
- When were the payment details changed?
- Who or what initiated the change?
- What evidence was used to approve it?
- Which systems processed the instruction?
- Was any relevant account accessed without authorization?
- What action was taken after the discrepancy was discovered?
The answers help investigators construct a timeline.
They also help distinguish confirmed facts from assumptions about the attacker.
The Digital Evidence Behind a Diverted Payment
| Evidence source | What it may establish |
|---|---|
| Original invoice | Legitimate supplier and payment obligation |
| Supplier correspondence | Instructions received and their apparent source |
| Email headers | Technical information about message delivery |
| Accounting audit logs | Changes to supplier or beneficiary records |
| Approval records | Which accounts approved the transaction |
| Identity logs | Relevant sign-ins and authentication activity |
| Bank transaction records | Amount, timing, and destination details |
| Supplier confirmation | Whether the account change was legitimate |
| Internal communications | How employees interpreted the instructions |
| Security alerts | Potential indicators of account compromise |
Not every organization retains all these records.
A professional investigation should identify missing evidence and explain how those limitations affect its conclusions.
The Timeline That Reveals the Fraud
Consider this fictional sequence:
| Time | Recorded event |
|---|---|
| Monday, 8:42 a.m. | Supplier bank-change email received |
| Monday, 9:06 a.m. | Employee opens the message |
| Monday, 9:24 a.m. | Supplier beneficiary details updated |
| Monday, 10:11 a.m. | Invoice approved |
| Monday, 11:03 a.m. | Payment submitted |
| Monday, 11:18 a.m. | Bank records transaction as processed |
| Thursday, 2:40 p.m. | Supplier reports nonpayment |
The timeline reveals the sequence of actions.
But it does not, by itself, establish who created the fraudulent email or whether an account was compromised.
Additional evidence may be required.
For example, an accounting audit trail may show which user changed the bank details.
Authentication logs may help determine whether the account was accessed unusually.
The supplier’s own records may establish that the new banking details were never authorized.
Together, these records can provide a stronger explanation than any one source alone.
Can a Fraudulent Bank Account Be Traced?
Banking records can identify the destination information associated with a payment.
But determining the ultimate beneficiary may require cooperation from financial institutions and, where appropriate, law enforcement.
Funds may be transferred onward after reaching the initial receiving account.
Investigators should not assume that the account holder is necessarily the person who organized the fraud.
An account could belong to a participant, intermediary, or person whose account was misused.
Attribution requires appropriate evidence.
Likewise, a business should not assume that discovering the destination account guarantees recovery.
The possibility of recovering funds depends on timing, payment systems, financial institutions, and other circumstances.
The First Hour After Discovering Payment Diversion
When a company discovers that money may have been sent to a fraudulent account, speed matters.
Contact the sending bank immediately. Report the suspected fraud and request urgent assistance with recall, tracing, or other available recovery procedures.
Preserve the payment information. Record the transaction reference, amount, destination details, and relevant timestamps.
Notify the appropriate internal teams. Finance, security, legal, and management may need to coordinate the response.
Verify the supplier through a trusted channel. Use previously established contact information rather than relying on details from the suspicious message.
Secure affected accounts. If compromise is suspected, review relevant sessions, credentials, and permissions.
Preserve evidence. Retain communications, accounting records, and available security logs.
Report the incident to relevant authorities. Follow the applicable reporting procedures in the organization’s jurisdiction.
A bank may be able to initiate urgent action, but recovery is not guaranteed.
Waiting for a complete forensic report before contacting the bank can waste valuable time.
Why Reversing the Payment Is Not Always Simple
A completed bank transfer may not be reversible merely because the sender later identifies fraud.
Different payment systems have different rules.
The receiving bank may need to investigate.
Funds may no longer remain in the original destination account.
Legal or regulatory requirements may also affect what action is possible.
Businesses should therefore treat bank notification as an urgent response step, not as a guaranteed solution.
A forensic investigation can help document the circumstances and support appropriate reporting, but it cannot independently compel a bank to return funds.
What If the Finance Employee Followed Every Internal Rule?
An incident may reveal that the organization’s established rules were inadequate.
The employee may have received a plausible supplier email, updated the record, obtained managerial approval, and submitted the payment.
Each step may have followed the documented procedure.
Yet the process may have lacked an independent check of the changed bank details.
This is a control-design problem.
An effective investigation should examine not only individual actions but also the workflow that permitted the transaction.
The objective is to understand how the fraud succeeded and reduce the likelihood of recurrence.
The Missing Control: Independent Supplier Verification
A strong supplier bank-change process should not rely solely on the email requesting the change.
Businesses can establish procedures requiring staff to confirm new payment details through a trusted contact method already on record.
The verification should be independent of the suspicious message.
A telephone number included in a fraudulent email should not be treated as a trusted verification channel.
For higher-risk changes, businesses may require a second authorized reviewer.
The exact process should reflect the organization’s size, transaction volumes, and risk exposure.
Why Two-Person Approval Can Still Fail
Two-person approval is useful, but it is not sufficient on its own.
If both reviewers rely on the same fraudulent supplier message, the second approval may simply repeat the original mistake.
The important question is what each reviewer independently verifies.
One person might confirm the invoice and business purpose.
Another might verify the beneficiary details through an established supplier contact.
Approval controls should be designed to test the information that matters, rather than merely adding another signature.
When Cloud and Identity Logs Become Critical
If investigators suspect that an email or accounting account was compromised, cloud audit records may be important.
Relevant records can include sign-ins, application access, administrative changes, and available mailbox activity.
But unusual sign-in information must be interpreted carefully.
Travel, VPN services, mobile networks, and legitimate automation can produce unfamiliar-looking activity.
An IP address alone does not prove who controlled an account.
Investigators should correlate identity records with the payment timeline and other available evidence.
For additional context, see Cyb3rsect’s Cloud Forensics guide.
Preserving Evidence Without Disrupting the Investigation
Fraud investigations can involve several systems operated by different teams.
Finance may control the accounting records.
IT may control email and authentication logs.
The bank maintains transaction records.
The supplier may possess its own communications and payment instructions.
Coordinating preservation is therefore essential.
Relevant records should be collected through authorized procedures, with attention to timestamps, source systems, and chain of custody where appropriate.
Investigators should avoid unnecessarily modifying original evidence.
See Cyb3rsect’s Digital Evidence Preservation guide for broader principles.
How Businesses Can Prevent Payment Workflow Hijacking
A resilient payment process should combine technical and procedural controls.
Verify beneficiary changes independently. Use established contact details.
Separate supplier maintenance from payment approval. Avoid giving one account unnecessary control over the entire process.
Review privileged accounting access. Restrict who can change banking information.
Use appropriate multi-factor authentication. Protect email, accounting, and financial accounts.
Monitor unusual changes. Flag new beneficiaries and modifications to supplier records.
Require meaningful approval. Ensure reviewers verify payment destinations, not just invoice amounts.
Preserve audit trails. Maintain records of changes and approvals.
Train finance employees. Explain supplier impersonation and business email compromise.
Establish a bank fraud response procedure. Employees should know whom to contact immediately.
Reconcile supplier payments. Detect discrepancies promptly rather than waiting for overdue-payment complaints.
No single safeguard eliminates all payment fraud.
Layered controls reduce the chance that one deceptive instruction will redirect a legitimate transaction.
What a Professional Payment Fraud Investigation Report Should Include
A structured report may document the original payment obligation, fraudulent instruction, accounting changes, approval history, bank transaction, and relevant account activity.
It should distinguish between confirmed facts and unresolved questions.
For example:
- Was the supplier impersonated?
- Was a genuine email account compromised?
- Did an authorized employee change the beneficiary?
- Were approval controls followed?
- Was the payment successfully redirected?
- What records support the conclusion?
- What remains unknown about the recipient or attacker?
The report should also identify evidence limitations and recommended control improvements.
For more information about reporting standards, see Digital Forensic Report: What a Professional Forensic Report Should Contain.
How Cyb3rsect Approaches Payment Fraud Investigations
At Cyb3rsect, our digital investigation content focuses on understanding the technical and procedural events behind suspicious financial activity.
An authorized investigation may involve reviewing business communications, accounting audit trails, identity records, relevant documents, and transaction information.
The objective is to reconstruct the payment process and establish where the intended workflow was manipulated.
Not every diverted payment involves a hacked bank account.
Not every fraudulent supplier email proves that the supplier was compromised.
And not every authenticated transaction reflects a genuinely authorized business decision.
Evidence-based investigation helps separate these possibilities.
Final Thoughts: The Fraud Happened Before the Money Moved
Payment diversion often succeeds before the bank transfer is submitted.
The attacker may have already manipulated the supplier details, the employee’s understanding, or the approval process.
By the time the bank receives the instruction, the transaction may appear entirely routine.
That is why businesses must protect the information and decisions leading up to payment—not just the final banking login.
Strong supplier verification, meaningful approvals, account security, and reliable audit records can make fraudulent changes harder to conceal.
When an incident occurs, rapid bank notification and structured digital evidence preservation are essential.
The bank may have processed an authenticated payment. The investigation must determine whether the business was deceived into authorizing it.
For more information about corporate investigations, digital evidence, and financial cybercrime, visit Cyb3rsect.
