# Invoice fraud: when the email is genuine > Three real cases, one of them €400,000. Why the usual warning signs don't help, and the one rule that stops all three. ## Three stories, one scheme This lesson is about a type of fraud you won't recognise by an odd address or spelling mistakes, because there aren't any. It's called BEC — business email compromise. Three real cases from Lithuanian companies, anonymised. The scheme is the same in all of them. The outcomes differ. And it wasn't the technology that made the difference. ## Case one: an invoice from Italy A company accountant received an email from an Italian supplier with an invoice for services recently delivered. The service really had been provided. The company had worked with this supplier for years. The email had one extra sentence: because of problems at the bank, the payment had to go to a different account number. The transfer was made. A month later the supplier asked why the invoice was still unpaid. ## Why nothing would have helped The scammers had got into the **supplier's** mailbox. They intercepted genuine emails and changed one field in the document. Let's check that email against the usual advice: - Sender address — **genuine**. Not similar; the same one. - Mailbox and email thread — **genuine**. - Invoice — **genuine**, for work actually done. - Relationship — **long-standing**, not a first payment. - Language — **clean**, no urgency or threats. Only one thing changed — the **account number**. > **Schema.** An invoice where everything is genuine except one field: the sender address is genuine, the email thread is genuine, the invoice is for real work, the amount is right, the language is clean. Only the IBAN changed — and that is exactly what nobody checks. How the scammers end up in the supplier's mailbox, and why nobody notices: > **Schema.** The fraud over time: someone at the supplier clicks a fake link and the mailbox is taken over; the scammers set up a silent forwarding rule; for days or weeks they read who pays what; the supplier sends a genuine invoice; the scammers add a sentence about a new account number; you pay; a month later the supplier asks why it is unpaid. ## Case two: an email from the director's mailbox Another client's director got a notice that important unread emails were waiting in his Microsoft 365 account. He clicked, entered his password, entered his 2FA code — and “something went wrong”. The scammers took over the mailbox and for **two weeks** quietly read everything coming in and going out. Then they found a genuine thread between the director and the accountant, copied it, and asked her to pay **€100,000** against a pro-forma invoice. The email came from the **director's genuine mailbox**, in a genuine thread, in correct Lithuanian and in a perfect copy of his writing style. ## “2FA didn't work” — it's not a glitch This sentence is worth remembering for life. The fake page passes your password and code to the real Microsoft in real time, takes the login **session** and lets the scammer in. You see an “error” — he sees your mailbox. > **Schema.** How an AiTM attack works: you enter your password and 2FA code on a fake Microsoft page. In the same second it passes them to the real Microsoft, receives the login session and keeps it, while showing you an error. The scammer gets into the mailbox even though MFA was on. A passkey or a hardware key breaks this chain because it only works on the real Microsoft address. That's why MFA with an SMS or app code isn't bulletproof. Only **passkeys or hardware keys** resist this attack, because there's no code to pass on. And that's why, after an incident like this, changing the password **isn't enough**: active sessions must be revoked and the mailbox rules checked — scammers often start by setting up silent email forwarding. ## How case two ended The accountant worked next to the director's office. She simply walked in and asked whether he'd really sent it. The director went straight to IT, the mailbox was recovered, and the money stayed in the company. Compare: in case one everything looked fine and nobody asked. In case two nobody recognised the attack technically — one person simply decided to check. > The question “did you really send this?” is a company's cheapest security measure. ## Case three: €400,000 So you don't get the impression we're talking about small change: an accountant at a large Lithuanian company, following the same scheme — **a changed account number** — transferred **€400,000**. The money could not be recovered. What saved the company was that it had **fraud (cyber-risk) insurance**. The excess was €50,000, so there was still a loss — but €50,000 instead of €400,000. > **Schema.** The effect of insurance: €400,000 transferred to scammers, €0 recovered, and the company's loss with fraud insurance was a €50,000 excess. Three lessons from this case: 1. **Size is no protection.** The bigger the company, the more normal a big transfer looks — scammers know this and target exactly those companies. 2. **Getting it back is almost impossible.** Within hours the money is split across several accounts abroad. So the only real hope is stopping the transfer the same day. 3. **Insurance is the last layer, not the first.** It doesn't prevent the attack, but it turns a loss that would sink the company into one that hurts but is survivable. ## Is cyber-risk insurance worth it? Briefly, the questions managers ask most: - **What's covered.** Depending on the policy — money lost to fraud, incident investigation, data recovery, business interruption, legal help. - **The excess.** Part of the loss always stays with you. For small companies it starts at a few hundred euros; for large ones it reaches tens of thousands. - **The insurer checks you before issuing a policy.** Practically all of them scan the company's external infrastructure and require critical gaps to be fixed. That means **without decent security you simply won't get insurance** — or you'll get expensive insurance. - **Insurance doesn't replace MFA and procedures.** It's for what's left after them. A good start is a conversation with your insurance broker and the question: *“does our policy cover a transfer to scammers because of a changed account number?”* — because not every policy does, and that clause is the one that matters most. Useful sources (in Lithuanian): [Colemont overview of cyber-risk insurance in Lithuania](https://colemont.lt/kibernetiniu-riziku-draudimas-lietuvoje-lloyds-of-london-colemont/) · [BTA cyber security insurance terms (PDF)](https://www.bta.lt/media/Taisykles-privatiems/Cyber/kibernetinio-saugumo-taisykles-2026.pdf) ## The rule that works in both cases > **The account number changes, or an unplanned payment is requested → call.** > On a number you already knew. Not the one in the email. Thirty seconds on the phone. Always — even if you've known the supplier for ten years. Especially then, because that's exactly when nobody gets suspicious. > **Schema.** A decision chart before a payment: if the account number changed or an unplanned or urgent payment is requested, call a number you already knew, not the one in the email. If it is confirmed by voice, you can pay, and above a set amount a second signature is needed. If it is not confirmed or nobody answers, don't pay and tell IT. If nothing changed, check the bank details against the supplier list. ## A procedure in 15 minutes — written by AI Rules only work when they're written down and everyone has seen them. AI will help write them — copy this, fill in your details instead of the square brackets and send it: ```text Help me write a short, one-page payment security procedure for our company. ABOUT US - Business and number of employees: [...] - Who prepares payments: [job title] - Who approves them: [job title] - Which bank we use: [...] THE PROCEDURE MUST INCLUDE 1. How supplier bank details are changed: never by email, confirmed by a phone call to a number we already knew, who records it and where. 2. An amount above which two people must approve. Suggest a limit for our size. 3. What to do when an urgent request comes from the director's email. 4. What to do in the first hour if the money has already gone. 5. One sentence for staff: asking and checking is good, even if the director is asking. PROCESS First ask me the missing questions, one at a time. Then show me a draft. Write in English, simply, without legal jargon. Don't invent anything about our company — if a fact is missing, ask. ``` Print the result and have everyone who prepares or approves payments sign it. Point five matters most: an accountant afraid of “bothering the director” is a security gap. In case two, €100,000 was saved by exactly that question. ## Check your mailbox in 2 minutes Once they've taken over a mailbox, scammers first make sure you won't notice them: they set up **forwarding** (every email goes to them too) or a **rule** that hides replies — for example, moving emails containing the word “invoice” or “payment” to a folder nobody looks at. Check that your mailbox has nothing you didn't create:

Outlook / Microsoft 365

In the browser, outlook.office.com

  1. ⚙ Settings → Mail.
  2. Forwarding: is it switched on to an unknown address?
  3. Rules: are there rules you didn't create — especially ones that move or delete emails?

Gmail / Google Workspace

In the browser, mail.google.com

  1. ⚙ → See all settings.
  2. Forwarding and POP/IMAP: is there an address you don't know?
  3. Filters and Blocked Addresses: are there filters you didn't create?
Found something odd? **Take a screenshot and tell IT straight away.** The rule is evidence of when and how the scammers got in. If IT can't be reached quickly, switch off the forwarding yourself — but only after taking the screenshot. ## Can AI help? Partly — and it's important to know where the limit is. **It can:** paste in the email (without personal data) and ask it to check whether the domain matches, whether there are fake letters, whether the wording doesn't match the style of earlier correspondence. Scammers have to write new text, so the tone is often “almost the same”. AI notices that kind of mismatch. **It can, every month:** if you enter invoices into a spreadsheet with AI, the same AI compares this month's IBANs with last month's and shows which ones changed. How to do it — in the lesson **[Invoices from email straight into a spreadsheet](/en/lessons/invoices-to-spreadsheet)**. **It can't:** confirm that an IBAN belongs to your supplier. It has no access to bank data, and its answer can sound convincing and still be wrong. > So AI is **a second opinion before the call**, not instead of it. > Only a person on the phone confirms an account number. ## If the money has already gone 1. **Call the bank immediately** — in the first hours a transfer can sometimes still be stopped or recalled. 2. Report it to the police. 3. Warn the supplier — their mailbox is probably hijacked and there are more victims. 4. Contact IT: revoking sessions, passwords, mailbox rules, logs. 5. Don't delay out of embarrassment. This scheme fools experienced people — that's why it works. Need help right now? **pagalba@itbroliai.lt** · **+370 618 05093** ## Check yourself Six questions on what you've just read. At the end you'll get a certificate with your score.