Spot the scam: the invoice that isn't.

Dear reader,

It is a Friday afternoon, which is not an accident. Your finance person opens an email from a supplier you have paid a dozen times before. The subject line references a real invoice number. The body is polite, slightly apologetic, and asks that this month’s payment go to a new account, because the old one is “under review.” A PDF is attached, formatted the way that supplier always formats things. Nothing about it looks unusual, which is exactly the point.

This is one of the oldest tricks in business email, and it still works because it asks nobody to do anything dramatic. Nobody clicks a strange link. They do the most ordinary task in the accounts calendar: pay an invoice. The only thing that has changed is where the money goes.

The three tells

A payee change buried in a reply thread. Real conversations get hijacked. The scammer often does not send a fresh email; they reply inside an existing thread with your supplier, sometimes after quietly compromising one side of it. A bank account change that arrives as a reply, rather than a separate confirmed notice, deserves suspicion on that fact alone.

Urgency about a deadline that was not urgent last month. “Please process today, our accounts team is closing early” is doing a job: buying your finance person’s hesitation before they have time to use it. Genuine suppliers are usually relaxed about payment timing, because they trust the relationship.

A domain one letter off. Look at the sender address, not the display name. accounts@suppliername.com and accounts@suppl1ername.com render almost identically in a busy inbox. Some versions swap a letter, add a hyphen, or use a lookalike domain ending. The display name usually still shows the supplier’s real name, because that part is easy to fake and the address is not.

None of these three, alone, proves fraud. Together, on the same email, they are close to a certainty.

The two-minute check

Before any bank account change goes into the payment system, call the supplier on a number you already have on file, never the number in the email. If the email offers a new phone number for “urgent queries,” that number belongs to the scammer. Use the contact you have used before, or the number on the supplier’s own website, typed in independently rather than clicked from the message.

Ask one plain question: did you send this, and did your bank account change. A genuine supplier will confirm in seconds and will not be surprised you asked. Confirm any account change by voice before it goes near a payment run, every time, regardless of how many times you have paid this supplier before.

That costs two minutes against a payment that, once it lands in the wrong account, is very hard to bring back.

If the money has already moved

Call your bank immediately and ask for a fraud or scam recall on the transaction; banks can sometimes intercept a transfer in its first hours, and every hour matters. Then report it: the police hotline is 1800-255-0000, and www.scamalert.sg has the current reporting channels, including ScamShield resources for verifying numbers and links. State what happened calmly and in order: what the email said, when you paid, and when you noticed. The Cyber Security Agency’s advisories are worth a look afterwards too, since business email compromise of this shape gets flagged there when active.

The human close

The joke, if there is one here, is on the trick, never on the person who nearly paid it. Anyone can nearly pay it. The email is written by someone whose full-time job is making the ordinary look ordinary, and catching that takes nothing more than a habit: new account, always a call.

If a payment has already gone and you want a hand working out what to check next, talk to us; if a term in this letter was new, the decoder explains the jargon in plain English.

We’ll take it from here. For more notes like this, back to Letters from the neighbourhood.