Invoice fraud in 2026: when a client pays the wrong bank

Invoice redirection fraud happens when someone tricks your client into paying your invoice into the wrong bank account. It usually starts with a hijacked email, followed by a polite message about "new bank details." You protect yourself by keeping payment details in one place that is not email, confirming any change by phone, and acting within hours if money goes astray.

How the scam works on a small business

The version aimed at small businesses is simpler than the big-company stories about finance departments and wire transfers.

The FBI defines business email compromise (BEC) in its 2025 Internet Crime Report as a scam "targeting businesses or individuals working with suppliers," carried out by compromising email accounts and other communication channels to carry out an unauthorized transfer of funds. Individuals who work with suppliers are you and every client you have.

Four patterns come up again and again.

The thread hijack. Someone gets into your mailbox or your client's and waits. When your invoice goes out, they reply from a lookalike domain with a "corrected" PDF and an apology about a bank change.

The quiet forwarding rule. An attacker adds a rule that forwards anything containing "invoice" or "payment" to an outside address. Nothing looks wrong in your inbox.

The attachment swap. The email really is from you, but the PDF was replaced or edited, and only the bank line differs.

The phone call. A voice claiming to be your bank or your client's accounts team "confirms the new details." It lands at the moment a payment is expected, which is why it works.

None of these needs advanced skill. They need a mailbox and some patience.

What the FBI figures show

The numbers come from the FBI's Internet Crime Complaint Center (IC3), and they only count what victims report. In 2025 it logged 1,008,597 complaints and $20.877 billion in reported losses. Business email compromise accounted for $3,046,598,558 of that, behind investment fraud and ahead of tech support scams. The report's table shows BEC at $2,770,151,146 in 2024 and $2,946,830,270 in 2023, so the number is steady, not a spike.

Two details matter more to a small business than the total.

First, the money moves on ordinary rails. In the report's breakdown of how victims paid, 86% of BEC losses went by wire transfer or ACH. Not cards, and not crypto. The way your clients already pay you.

Second, speed decides the outcome. The IC3 Recovery Asset Team ran 3,900 freezing actions in 2025 against $1,163,919,846 of attempted theft and froze $679,013,183, a 58% success rate. That figure covers all fraud types in the program, not only BEC, and the report notes BEC was once the majority of cases but tech support and account takeover cases have risen. The advice is the same in every case: if you discover a fraudulent transfer, contact your bank immediately and ask for a recall, then file at ic3.gov regardless of the amount.

The FBI has published on this for years. Its public service announcement on BEC counts about $55.5 billion in exposed losses worldwide between October 2013 and December 2023, across 305,033 incidents. Its prevention tips include verifying any request to change account information through a second channel.

Why small businesses are an easy target

A finance department has controls that irritate fraudsters: dual approval, a supplier list and a person whose job is to compare bank details with a record. You have none of that.

The timing helps the attacker too. Xero's US small business data for the March 2026 quarter shows that small businesses waited an average of 28.8 days to be paid, and invoices were paid 9.0 days late on average. That is more than a month in which an unpaid invoice sits in two inboxes and neither side finds silence strange. A swapped bank detail can go unnoticed for weeks.

The shape of the work adds to it. New clients arrive by email from people you have never met. Payment details travel as attachments. Project threads run for months, so a hijacked thread has plenty of context to copy. Many invoices are cross-border, so an unfamiliar IBAN raises no alarm. And there is nobody down the hall to ask whether the request looks right.

Vigilance is a weak defence, because it fails on a Friday afternoon in week nine of a project. A simple rule that removes the decision works better.

Add a rule to your contract

Two sentences in your terms do most of the work: "Payment details for this engagement are those on the signed contract or the invoice page. Any request to change bank details, from either side, is void unless confirmed by phone on a number held before the request was made."

The second sentence matters most. It commits both sides to a callback, and it makes an attacker beat a written rule instead of a busy person's instinct. A client's finance team will not object, because it is the control their own auditors expect. Have a lawyer check the exact wording for your country.

The payment system is starting to help

For years nothing checked that a name matched an account number. That is changing.

In the euro area, payment providers have had to run a verification of payee check since 9 October 2025, according to the European Commission. The check compares the beneficiary's name with the IBAN before the payment goes out, and the service must be free of charge. The Commission also lists a January 2027 date for instant euro payments outside the euro area.

In the UK, Pay.UK's Confirmation of Payee does something similar for domestic payments. It lets a payer check the account name, including whether it is personal or business, before paying.

Both help only when the name on your invoice matches the name on your account. If you invoice as one trading name and bank as another, legitimate payments may trigger a mismatch warning, and clients who get used to ignoring warnings are easier to defraud. Keep the names consistent. Outside Europe and the UK, assume there is no name check at all.

Six changes that close the gap

Most advice on this is for show. These six are not.

1. Publish bank details in one place that is not email. An invoice on a page the client logs into cannot be edited in transit by someone who never had access to it. Email attachments can be.
2. Make "we changed our bank details" a phone call, in both directions, to a number you already had.
3. Protect the mailbox that sends invoices with strong sign-in, such as a passkey or hardware key. The mailbox is the real target, more than the bank account.
4. Check your forwarding rules monthly. Look for rules you did not create, rules that forward outside, and rules that mark messages as read. It takes a couple of minutes.
5. Ask for confirmation, not a reminder. Two weeks after you send an invoice, ask the client to confirm it was paid and into which account. Almost nobody asks "which account."
6. Vet new clients before the first invoice. The tricks that fake a bank change also fake a whole client. Our checklist for spotting fake clients covers that side.

The first hour after a wrong payment

Work in this order. Call your bank, and have the client call theirs, and ask for a recall. Ask both banks about indemnification paperwork. Report it at ic3.gov if anyone involved is in the US, or to your national body otherwise. Keep everything, including full email headers, before anyone deletes messages. Change the mailbox password and sign out other sessions. Then tell the client plainly what happened.

Do not spend the first hour deciding whose fault it is. That gets sorted after the recall request, which has a shelf life of hours. If a dispute continues after the money has moved, our post on payment disputes covers what evidence helps.

How Delivvo takes bank details out of email

Delivvo cannot stop a client's mailbox from being hacked. What it does is remove the habit that the scam depends on, which is sending payment details as an attachment and then correcting them by email.

Here is the flow:

1. You send the quote, and when the client accepts, the invoice is created from it with a sequential number in your format.
2. The client opens the invoice on a link and pays on the page through your own processor, such as Stripe, PayPal or Square. Nobody types bank details into an email or edits a PDF.
3. The money goes from the client to your gateway account. Delivvo takes 0% and never holds it.
4. Every invoice, receipt, contract and quote carries a verification code. A client or their bookkeeper can enter it on the verify page and see the issuer, the number, the dates, the amount and the status, so a PDF that has been altered does not match.
5. The client portal opens with a one-time code and no password, and it keeps the quote, contract, invoices and files together. A message that says "our details changed" can be checked against what the portal shows.

This will not protect a client who ignores the page and pays a number from a fake email. Say so in your onboarding message: "Invoices are paid only from the link in your portal. We never send bank details by email." If a mistake does happen, the record helps. Voiding an invoice or issuing a credit note keeps the original on file, so you can show exactly what was sent, when, and for how much when you talk to a bank or the police.

See how verification works.

Delivvo is a CRM and client portal for service businesses. See how payments work.

FAQ