Invoice fraud: when the email is genuine

Three stories, one scheme

This lesson is about a type of fraud you won’t recognise by an odd address or spelling mistakes, because there aren’t any. It’s called BEC — business email compromise.

Three real cases from Lithuanian companies, anonymised. The scheme is the same in all of them. The outcomes differ. And it wasn’t the technology that made the difference.

Case one: an invoice from Italy

A company accountant received an email from an Italian supplier with an invoice for services recently delivered. The service really had been provided. The company had worked with this supplier for years.

The email had one extra sentence: because of problems at the bank, the payment had to go to a different account number. The transfer was made.

A month later the supplier asked why the invoice was still unpaid.

Why nothing would have helped

The scammers had got into the supplier’s mailbox. They intercepted genuine emails and changed one field in the document.

Let’s check that email against the usual advice:

• Sender address — genuine. Not similar; the same one.
• Mailbox and email thread — genuine.
• Invoice — genuine, for work actually done.
• Relationship — long-standing, not a first payment.
• Language — clean, no urgency or threats.

Only one thing changed — the account number.

How the scammers end up in the supplier’s mailbox, and why nobody notices:

Case two: an email from the director’s mailbox

Another client’s director got a notice that important unread emails were waiting in his Microsoft 365 account. He clicked, entered his password, entered his 2FA code — and “something went wrong”.

The scammers took over the mailbox and for two weeks quietly read everything coming in and going out. Then they found a genuine thread between the director and the accountant, copied it, and asked her to pay €100,000 against a pro-forma invoice.

The email came from the director’s genuine mailbox, in a genuine thread, in correct Lithuanian and in a perfect copy of his writing style.

“2FA didn’t work” — it’s not a glitch

This sentence is worth remembering for life.

The fake page passes your password and code to the real Microsoft in real time, takes the login session and lets the scammer in. You see an “error” — he sees your mailbox.

That’s why MFA with an SMS or app code isn’t bulletproof. Only passkeys or hardware keys resist this attack, because there’s no code to pass on.

And that’s why, after an incident like this, changing the password isn’t enough: active sessions must be revoked and the mailbox rules checked — scammers often start by setting up silent email forwarding.

How case two ended

The accountant worked next to the director’s office. She simply walked in and asked whether he’d really sent it.

The director went straight to IT, the mailbox was recovered, and the money stayed in the company.

Compare: in case one everything looked fine and nobody asked. In case two nobody recognised the attack technically — one person simply decided to check.

The question “did you really send this?” is a company’s cheapest security measure.

Case three: €400,000

So you don’t get the impression we’re talking about small change: an accountant at a large Lithuanian company, following the same scheme — a changed account number — transferred €400,000.

The money could not be recovered.

What saved the company was that it had fraud (cyber-risk) insurance. The excess was €50,000, so there was still a loss — but €50,000 instead of €400,000.

Three lessons from this case:

1. Size is no protection. The bigger the company, the more normal a big transfer looks — scammers know this and target exactly those companies.
2. Getting it back is almost impossible. Within hours the money is split across several accounts abroad. So the only real hope is stopping the transfer the same day.
3. Insurance is the last layer, not the first. It doesn’t prevent the attack, but it turns a loss that would sink the company into one that hurts but is survivable.

Is cyber-risk insurance worth it?

Briefly, the questions managers ask most:

• What’s covered. Depending on the policy — money lost to fraud, incident investigation, data recovery, business interruption, legal help.
• The excess. Part of the loss always stays with you. For small companies it starts at a few hundred euros; for large ones it reaches tens of thousands.
• The insurer checks you before issuing a policy. Practically all of them scan the company’s external infrastructure and require critical gaps to be fixed. That means without decent security you simply won’t get insurance — or you’ll get expensive insurance.
• Insurance doesn’t replace MFA and procedures. It’s for what’s left after them.

A good start is a conversation with your insurance broker and the question: “does our policy cover a transfer to scammers because of a changed account number?” — because not every policy does, and that clause is the one that matters most.

Useful sources (in Lithuanian): Colemont overview of cyber-risk insurance in Lithuania · BTA cyber security insurance terms (PDF)

The rule that works in both cases

The account number changes, or an unplanned payment is requested → call. On a number you already knew. Not the one in the email.

Thirty seconds on the phone. Always — even if you’ve known the supplier for ten years. Especially then, because that’s exactly when nobody gets suspicious.

A procedure in 15 minutes — written by AI

Rules only work when they’re written down and everyone has seen them. AI will help write them — copy this, fill in your details instead of the square brackets and send it:

Help me write a short, one-page payment security procedure for our company.

ABOUT US
- Business and number of employees: [...]
- Who prepares payments: [job title]
- Who approves them: [job title]
- Which bank we use: [...]

THE PROCEDURE MUST INCLUDE
1. How supplier bank details are changed: never by email, confirmed by
   a phone call to a number we already knew, who records it and where.
2. An amount above which two people must approve. Suggest a limit for our size.
3. What to do when an urgent request comes from the director's email.
4. What to do in the first hour if the money has already gone.
5. One sentence for staff: asking and checking is good, even if the director is asking.

PROCESS
First ask me the missing questions, one at a time. Then show me a draft.
Write in English, simply, without legal jargon. Don't invent anything about
our company — if a fact is missing, ask.

Print the result and have everyone who prepares or approves payments sign it. Point five matters most: an accountant afraid of “bothering the director” is a security gap. In case two, €100,000 was saved by exactly that question.

Check your mailbox in 2 minutes

Once they’ve taken over a mailbox, scammers first make sure you won’t notice them: they set up forwarding (every email goes to them too) or a rule that hides replies — for example, moving emails containing the word “invoice” or “payment” to a folder nobody looks at.

Check that your mailbox has nothing you didn’t create:

Found something odd? Take a screenshot and tell IT straight away. The rule is evidence of when and how the scammers got in. If IT can’t be reached quickly, switch off the forwarding yourself — but only after taking the screenshot.

Can AI help?

Partly — and it’s important to know where the limit is.

It can: paste in the email (without personal data) and ask it to check whether the domain matches, whether there are fake letters, whether the wording doesn’t match the style of earlier correspondence. Scammers have to write new text, so the tone is often “almost the same”. AI notices that kind of mismatch.

It can, every month: if you enter invoices into a spreadsheet with AI, the same AI compares this month’s IBANs with last month’s and shows which ones changed. How to do it — in the lesson Invoices from email straight into a spreadsheet.

It can’t: confirm that an IBAN belongs to your supplier. It has no access to bank data, and its answer can sound convincing and still be wrong.

So AI is a second opinion before the call, not instead of it. Only a person on the phone confirms an account number.

If the money has already gone

1. Call the bank immediately — in the first hours a transfer can sometimes still be stopped or recalled.
2. Report it to the police.
3. Warn the supplier — their mailbox is probably hijacked and there are more victims.
4. Contact IT: revoking sessions, passwords, mailbox rules, logs.
5. Don’t delay out of embarrassment. This scheme fools experienced people — that’s why it works.

Need help right now? pagalba@itbroliai.lt · +370 618 05093

Check yourself

Six questions on what you’ve just read. At the end you’ll get a certificate with your score.