Invoice Redirection Scams: The Email That Quietly Steals Your Payment

It usually arrives looking completely ordinary. An email from a supplier you’ve paid a dozen times before, attached to an invoice you were expecting, with one small line added near the bottom: “Please note our bank account details have recently changed.” You update the payee, pay the invoice, and move on with your day. Three weeks later the real supplier rings, wondering where their money is.

This is invoice redirection — one of the most expensive scams hitting New Zealand businesses right now, and one of the hardest to spot, because almost nothing about it looks wrong.

How the scam actually works

Invoice redirection is a form of business email compromise. The fraudster doesn’t guess at your suppliers — they get inside the conversation. Typically it runs like this:

• A supplier’s email account is compromised, often through a phishing link or a reused password.
• The scammer quietly watches genuine invoices going back and forth, learning the tone, the amounts and the timing.
• At the right moment they send a real invoice — or a near-perfect copy — with the bank account changed to one they control.
• You pay. The money is moved out of that account within hours, often offshore, before anyone notices.

Because the email comes from a familiar name, references a real job, and arrives exactly when you expected it, the usual alarm bells never ring.

The red flags worth slowing down for

No single sign confirms a scam, but any of these should make you stop and verify before you pay:

• “Our bank account has changed.” This is the single biggest one. Legitimate account changes are rare — treat every one as suspicious until proven otherwise.
• Urgency or secrecy. “Can you pay today,” or “process this before end of day” — pressure is designed to stop you checking.
• A slightly different email address. A swapped letter, an extra dot, or .co instead of .co.nz.
• The new account is in a different name to the business you’re paying.
• Reply-to doesn’t match the sender, or the formatting is subtly off from previous invoices.

The one habit that stops it cold

If you take one thing from this article, make it this: verify any change of bank details by phone, on a number you already trust — not the number on the new invoice or in the email signature. A thirty-second call to a known contact at the supplier defeats almost every invoice redirection scam ever run. Build it into your accounts process so it isn’t left to whoever happens to open the email.

For added protection, use dual approval for any new payee, enable payee name-checking with your bank, and make “account changed” messages a mandatory stop-and-verify trigger for every staff member who touches payments.

If you’ve already paid — move fast

Speed is everything, because the funds are usually moved within hours. In order:

• Call your bank immediately and ask them to attempt a recall of the payment.
• Change passwords on any email account that may have been compromised, and turn on two-factor authentication.
• Report it to NetSafe and to the Police (105 for non-emergencies).
• Warn the genuine supplier — their email may be compromised and you won’t be the only customer targeted.
• Preserve everything — the emails, headers, invoice and payment confirmation. This is the evidence trail.

Where an investigator comes in

Banks recover some funds, but often only part — and the trail doesn’t end at the first account. Where a meaningful sum has gone, a licensed investigator can help trace where the money and the people behind the account moved next, document the loss to an evidentiary standard for your bank or insurer, and support any civil recovery. Our skip tracing and Debt Shield work exists for exactly this point — when the money has left the building and someone has to go and find it.

Invoice redirection works because it hides inside the ordinary. The defence is equally ordinary: slow down on any change of bank details, pick up the phone, and verify. It costs you thirty seconds. It can save you thirty thousand dollars.

← Back to all articles