Invoice fraud, also called invoice redirection or business email compromise (BEC), is when a criminal poses as a supplier or a senior manager and gets your staff to pay into the wrong bank account. Irish SMEs lost almost €19 million to email-related scams over two years, according to FraudSMART. The fix is mostly process: a phone call to a known number before any bank detail change. ERS IT Solutions, in Blanchardstown, Dublin 15 since 1983, adds the email and account security that makes these scams harder to start.
What is business email compromise?
Ireland's National Cyber Security Centre defines business email compromise as cybercrime where attackers impersonate a legitimate business contact, often an executive, supplier or employee, to trick people into transferring money or sensitive data. The common types it lists are:
- Supplier fraud (invoice redirection). A supplier's email is compromised or copied and used to send fake invoices or change payment details.
- CEO fraud. An attacker pretends to be a company executive and asks for an urgent transfer.
- Payroll diversion. HR or payroll staff are asked to change an employee's bank details.
- Legal representative impersonation. Criminals pose as solicitors or legal counsel to pressure someone on a "confidential" matter.
How does invoice redirection fraud work?
FraudSMART, the fraud awareness initiative run by Banking and Payments Federation Ireland, describes the usual pattern. You receive an email that appears to come from an existing supplier saying their bank details have changed. Often there is no payment requested at the time. You update the details. The next genuine invoice is then paid to the fraudster's account. The loss usually comes to light weeks later when the real supplier chases payment, and you still owe them.
The email can come from three places, according to An Garda Síochána:
- A spoofed address made to look like the supplier's.
- A lookalike domain, such as one letter changed in the supplier's name.
- The supplier's real mailbox, taken over with a stolen password or malware. This is the hardest to spot, because the email is genuine in every technical sense.
The NCSC points out that most BEC attacks do not involve malware, so traditional antivirus will not catch them.
How common is invoice fraud in Ireland?
These figures come from the organisations that publish them:
- Irish SMEs lost €18.9 million over two years through email-related scams, with average losses of over €22,000 per incident. Invoice redirection and CEO impersonation remain the top fraud risks to businesses. (FraudSMART, March 2026)
- In a FraudSMART and ISME survey, 67% of SMEs said they had been targeted by a financial scam in the previous 12 months, and 53% had no specific fraud awareness guidelines or training in place. (Same source, survey of 65 ISME members.)
- In 2021, almost €6 million was stolen from companies based in Ireland through business email compromise, and in most cases the money was transferred abroad. (An Garda Síochána)
Real Irish examples
From the NCSC's BEC guidance:
- Local authority, 2023. Paid over €500,000 to a fraudster after a fake invoice arrived from a spoofed supplier email address. Payment was made without secondary verification, and the loss was not recoverable.
- Private company, 2022. Had over €98,000 stolen through BEC, sent to a bank account in Portugal. Working with the bank, the payment was cancelled and all the money recovered.
From An Garda Síochána:
- Solicitor's email, 2019. A fraudster took over a solicitor's legitimate email and secured client funds being handled for a house purchase. €177,000 was stolen. The Garda National Economic Crime Bureau recovered all but €3,000.
- Early reporting, 2020. Because the fraud was reported quickly, the GNECB recovered €2 million from an account in Hong Kong, the entire amount stolen.
The pattern is clear: speed of reporting decides whether money comes back.
How to spot a fake supplier bank detail email
The NCSC and FraudSMART list the warning signs:
- Any request to change bank details, however routine it looks.
- Urgency or secrecy: "I'm in a meeting and can't talk", "keep this between us".
- An email address or domain that is slightly different from usual.
- A new IBAN in a different country from the supplier.
- Unusual tone, grammar or formatting.
- A request to bypass the normal approval process.
Remember that if the supplier's own mailbox has been taken over, none of the technical signs will show. That is why the process controls below matter more than spotting tricks.
How do I stop invoice fraud in an Irish business?
Payment process controls
These come from the NCSC, FraudSMART and Gardaí, and they cost almost nothing:
- Call back on a known number. Verify every request to change bank details by phoning the supplier on a number you already hold, never one from the email. FraudSMART's case study shows why: the victim confirmed the new details on a call, but only after the fraud.
- Dual authorisation. Require two people to approve any electronic third-party payment, and any change to payee details.
- Delay large or first payments to new account details by default, to allow time for checks.
- Check the IBAN. Gardaí suggest checking where the IBAN is located, as well as the URL and email spelling.
- Keep a verified supplier list with confirmed contacts.
- Train finance, payroll and admin staff specifically on BEC. FraudSMART says more than half of SMEs have no fraud awareness guidelines.
- Make it safe to pause. Staff should know they will never be blamed for delaying a payment to check it.
Email and account security controls
The NCSC's guidance on the technical side:
- MFA on all email accounts, so a stolen password is not enough to take over a mailbox.
- SPF, DKIM and DMARC on your domains, so criminals cannot easily send email that appears to come from you. Our email security guide explains each.
- Block or flag lookalike domains and email from newly registered domains.
- Email filtering and anti-spoofing tools to flag anomalies, such as a "CEO" email sent from outside.
- Monitor sign-ins and account activity. An attacker inside a mailbox can read your email and wait for the right invoice to change. Microsoft 365 monitoring alerts on impossible travel, unusual login times, privilege changes and rogue OAuth apps.
- Watch for leaked passwords with dark web monitoring.
- Limit what you publish. The NCSC notes attackers often know the names of your finance staff before they send a single email.
What to do if you have paid a fraudulent invoice
Act within minutes, not days. The Garda advice is that these transactions "can move very quickly".
- Call your bank's fraud team immediately and ask for a recall of the payment.
- Report it to your local Garda station. Gardaí ask for the emails with full header information, details of the fraudulent account, and confirmation that the change was not authorised (Garda guidance).
- Tell your IT provider so they can check whether your own mailbox was compromised and lock it down.
- Preserve evidence. Do not delete the emails.
- Warn the genuine supplier, as their mailbox may be the one compromised.
- Report to the NCSC, which its BEC guidance lists alongside Gardaí.
- Check whether personal data was exposed. If a mailbox was taken over, you may need to notify the Data Protection Commission within 72 hours.
- Tell your insurer, though note many cyber policies limit or exclude social engineering fraud. See our cyber insurance guide.
Even if the attempt failed, report it. Gardaí say the account may be used to defraud others.
How ERS helps prevent business email compromise
- Phishing and BEC simulations. Our user awareness training includes fake CEO and internal impersonation tests, so finance staff practise saying no.
- 24/7 Microsoft 365 identity monitoring for account takeover, session hijacking and rogue OAuth apps.
- MFA and Conditional Access enforced across your Microsoft 365 tenant.
- Dark web monitoring for staff credentials.
ERS quotes per business after a short call. Contact us or call 01 885 9500.