Forged invoice payment details: how scammers deceive companies
On this page · 7
An accountant receives an email from a long-standing supplier: “Our bank account has changed, please make the next payment using the new details.” The email looks normal – the same signature, the same style, even a continuation of earlier correspondence. The invoice is paid. A week later the real supplier asks where the money is.
This is business email compromise – a scheme in which companies are the victims and the sums reach tens of thousands of euros. This article covers how it works, a real case and the simple rules that protect against it.
In short
- Any notice of a changed bank account must be confirmed by phone – by calling a number you already know.
- Scammers have often broken into the partner's or your own email and can see the real correspondence.
- Companies also receive SMS messages with fake links – on the company phone.
How the scheme works
- Access. Scammers break into the mailbox of the company or its partner, or create a very similar address (one letter changed in the domain).
- Observation. For some time they read the correspondence: who pays whom, what sums, when.
- Interception. Just before the payment they send an email with “new” details or an altered invoice.
- The transfer. The company pays into the scammers' account, often at a foreign bank. The fraud comes to light only when the real partner sends a reminder about the debt.
A real case from the police reports
Trakai district, September 2026. A company received by email forged invoice payment details of its foreign partners and transferred 54 374 € to the specified account at a foreign bank. A pre-trial investigation into fraud has been opened.
Companies fall victim to other schemes too: in October 2026 in Tauragė and Utena counties, companies received an SMS on the company mobile phone about a supposedly unpaid fine, entered their online banking details and lost 19 520 € and 22 368 €.
Variants of the scheme
| Variant | What it looks like |
|---|---|
| Changed supplier details | An email about a “new bank account” or an altered invoice |
| A fake instruction from the manager | “Pay this invoice urgently, I am in a meeting, I will explain later” |
| Change of salary account | An email to the HR department supposedly from an employee with a new account for their salary |
| A fake invoice for services | An invoice for a domain, register or directory that the company did not order |
Rules that protect
Company procedure
- A change of payment details – only after confirmation by phone. The call is made to the number from the contract or earlier contacts, not from the email received.
- The four-eyes principle. Larger payments and payments to new recipients are approved by two people.
- The sender's address is checked – all of it, to the end of the domain.
- Two-factor protection for email for all employees.
- Urgent instructions from the manager are confirmed by a call.
- Payment limits at the bank and notifications about every transfer.
What to do after paying
- Call your bank that very minute and ask them to stop or recall the transfer. With international transfers, hours decide everything.
- Report to the police via epolicija.lt or by calling 112.
- Inform the real partner – their email or yours may have been hacked.
- Change the email passwords, check the forwarding rules in the mailboxes – scammers often set up hidden forwarding of emails.
- Report the break-in to the National Cyber Security Centre (NKSC) by email at cert@nksc.lt.
Frequently asked questions
How do we check whether the partner's account has really changed?
Call the partner on the number you had before and ask them to confirm. Never use the contact details from the email itself.
Will the bank return the money if we made the transfer ourselves?
It depends on whether the transfer can still be stopped. That is why you need to contact the bank immediately.
How do scammers find out whom we pay and how much?
Most often they read your or your partner's hacked email. That is why after an incident it is essential to check the security of the mailboxes.
Sources
- Lietuvos policija. Paros įvykių suvestinės
https://policija.lrv.lt/lt/ivykiu-suvestines/ - Lietuvos bankas. Pakliuvau sukčiams: ką daryti?
https://www.lb.lt/lt/pakliuvau-sukciams-ka-daryti - Nacionalinis kibernetinio saugumo centras. Pranešti apie kibernetinį incidentą
https://www.nksc.lt/pranesti.html