The Office Paid a Fake Supplier Invoice

Why this matters

The first sign is almost never the fraud itself. It is a supplier asking why you have not paid, about three weeks after you did. By then the money has been sitting in someone else's account, and then not sitting there, for most of that time. This case is worked backwards from the record a fourteen-person HVAC shop found on the morning it noticed, because the record shows exactly where the payment got through, and the gaps in it show why nobody saw it sooner. If this has just happened to you, skip to "The first hours" and come back.

What the record showed on day 19

The owner got a call from the shop's equipment distributor: a large invoice for a condenser order was 30 days past due, and the account would go on credit hold. The office had paid it. The bank showed the payment, an ACH credit, gone 19 days earlier. Pulling every record that touched it produced this:

DAY -42  Forwarding rule created in assistant's
         mailbox: mail with "invoice" or "remit"
         copied to an outside address. No alert.
DAY -3   Email "from distributor AR" in the real
         invoice thread: new bank after audit,
         letter attached, sender domain one
         letter off the distributor's.
DAY -2   Assistant updates payee in bank bill pay.
         Bank sends "new payee added" email to the
         owner's address. Unread.
DAY 0    Payment released. Single approval.
DAY 1    Receiving account emptied (per the
         receiving bank, learned on day 20).
DAY 19   Distributor calls: invoice past due.
DAY 19   Bank fraud line called, 10:05 a.m.

Nothing in it is exotic. That is the finding.

Reading the gaps

The forwarding rule, six weeks before. This is how the attacker knew there was a large open invoice, who the AR contact was, and how the distributor wrote its emails. Someone got the assistant's email password, probably through a fake login page, and instead of doing anything visible they set up a quiet rule copying the useful mail out. A forwarding rule outlives a password change, so even an assistant who later changed her password would have kept leaking. The shop had no alert for new mailbox rules and no one looked. See related: Reading a Phishing Email Aimed at a Trade Shop.

The look-alike domain inside a real thread. The attacker replied into the genuine conversation, copied from the forwarded mail, from an address one character off the distributor's. In a long thread on a phone, the difference is invisible.

No call note. The vendor file had a phone number for the distributor's AR desk. Nobody dialled it. There is no entry anywhere saying the change was verified, because it was not. This is the gap that mattered; every other gap only made it possible.

The alert that went to the wrong person. The bank did its job and announced the new payee, to an inbox the owner checks twice a week. An alert that reaches someone who is not looking is a log entry, not an alert.

Single approval. The bill-pay system allowed the person who added the payee to release the payment. One person, one afternoon, one decision.

The first hours

When the owner realized what had happened, the order of calls decided what was recoverable. Here is what they did, which is close to right.

1. The bank's fraud line, within minutes. Not the branch, not the relationship banker's email: the fraud line, by phone. Ask for a recall of the payment (for a wire, a recall request; for an ACH, a return or reversal request) and for the bank to contact the receiving bank immediately to freeze what remains. Get a case or reference number and the name of the person. A recall is a request to the receiving bank, not an instruction it must obey, which is why speed is everything: the receiving bank can freeze and return funds that are still there, and almost nothing once they have moved.

2. The FBI's Internet Crime Complaint Center. File at ic3.gov the same morning, with the payment's date, amount, both account numbers and the bank's reference. The FBI's Recovery Asset Team works with banks to freeze funds and has had its best results on domestic wires reported within about the first 72 hours; a report on day 19 is still worth filing, because it creates the record your insurer and bank will ask for and links your case to others using the same accounts. Also file a local police report; many insurers require one.

3. Contain your own side. The forwarding rule was still running. The assistant's mailbox was secured from a clean device: password changed, all sessions signed out, the rule deleted, multifactor turned on. Until that happens the attacker can watch your recovery emails. This is the incident-response half and has its own procedure. See related: The First Hour After a Suspected Breach SOP.

4. The distributor, by phone. Tell them on the number you had, so they can check whether their side was involved and warn other customers, and ask them in writing to hold the credit hold while this is worked.

5. The insurer, the same day. Covered in its own section below.

Why the money mostly did not come back

The receiving bank reported on day 20 that the account had been opened weeks earlier in a name with no link to the distributor and emptied the day after the deposit, mostly by transfers onward. What remained, roughly a tenth of the payment, was frozen and eventually returned. This is the usual shape: the receiving account belongs to a money mule (a person, sometimes recruited through a fake job ad, whose account is used to pass stolen money along), and the funds are moved out within a day or two.

A recall on day 1 would very likely have caught most of it, since the money was still in the account until the next day. A recall on day 19 caught leftovers. The legal mechanics of a business payment do not help much here: federal consumer protection for electronic transfers does not cover a business account, and when a business sends a payment it authorized, even under deception, the law that governs the payment generally treats it as authorized. See related: Reg E + UCC 4A: ACH and Wire Fraud Protections for Trade Businesses, which covers that in full.

Who owns the loss

This is not legal advice, and it is the point in this case where an owner should stop reasoning alone.

The default instinct is that the shop still owes the distributor, because the distributor never received anything. That is often how it lands, but not always. Courts in different states have reached different results on who bears a loss when one side's mailbox was compromised and the other side paid without verifying, sometimes asking which party was better placed to prevent it. The answer depends on the state whose law governs the supply agreement, what the contract and the invoices say about payment instructions, and whose mailbox was actually compromised. In this case the evidence pointed at the shop's own mailbox (the forwarding rule), which weakens any argument that the distributor should share the loss.

Walk into a business attorney's office with: the timeline above, the change email with full headers (forwarded as an attachment), the bank's case number and correspondence, the IC3 confirmation, the supply agreement and the last three invoices, and whatever the insurer has said. Do not sign anything the distributor sends about the debt until the attorney has seen it.

The insurer conversation

There are two places this loss might be covered, and many shops have neither. A crime policy or a commercial package with a crime section may carry a social engineering or funds transfer fraud coverage; a cyber policy may carry a social engineering endorsement. These are often written with a sublimit well below the main policy limit, and some endorsements pay only if the insured followed a stated verification procedure, typically a callback to a number on file. That last condition is why the missing call note mattered twice: it let the money go, and it can let the insurer decline.

Give notice as soon as you know, by the method the policy specifies, even if you think it is not covered; late notice is its own reason for denial. Read the notice requirements in the policy itself or ask the agent. Many cyber policies also want you to call their incident hotline before hiring your own forensic or legal help, and may decline costs from vendors they did not approve. See related: What Cyber Insurance Applications Actually Ask.

The control that would have stopped it

Several controls would have narrowed this: an alert on new mailbox forwarding rules, multifactor on the assistant's email, dual approval on new payees, the bank alert going to a phone. Each is worth having. But each could also have failed: the attacker might have phished the second approver too, or the alert might have been ignored again.

The one control that would have stopped this payment by itself was a callback to the distributor's AR number from the vendor file before the payee was changed. The distributor never changed banks, so a two-minute call ends it. It works even with the mailbox fully compromised, the domain perfect and every alert unread. See related: The Verify-on-a-Second-Channel Rule, and The Vendor Bank Detail Change SOP for the standing procedure.

What would have changed the outcome

Found on day 1. If the new-payee alert had gone to the owner's phone, a call the evening of day minus 2 or the morning of day 0 stops the payment before it leaves, or recalls it while the money is still in the mule account. The difference between a near miss and this loss was the routing of one email.

Paid by check instead. A check to a changed remit-to address has its own exposure (the attacker collects it), but it takes days to clear, which gives a supplier's past-due call time to arrive first. Not a recommendation; a reminder that speed of payment is speed of loss.

The distributor's mailbox, not yours. If the forwarding rule had been on the distributor's side, the containment work is theirs, and the who-owns-the-loss conversation tilts differently, which is a reason to find out exactly where the leak was before you talk money with them.

References

• See related: The Verify-on-a-Second-Channel Rule
• See related: The First Hour After a Suspected Breach SOP
• See related: Reg E + UCC 4A: ACH and Wire Fraud Protections for Trade Businesses
• See related: Business Email Compromise and Wire Fraud Countermeasures for Trade Businesses
• FBI Internet Crime Complaint Center (ic3.gov) guidance on reporting business email compromise and the Recovery Asset Team