Payment diversion fraud: how the scam works and how to stop it

Payment diversion fraud is simple: a fraudster convinces you to send a payment you genuinely owe to a bank account they control. There is no malware to install and no system to break into. One email announcing new bank details, sent at the moment a payment is due, can be enough. The same scheme goes by several names (invoice fraud, bank details change scam, mandate fraud in the UK) and it is one of the main forms of business email compromise (BEC).

The scam targets the people who make payments, not the IT department. That is why the defences that work are mostly procedures: who checks a change of bank details, how, and through which channel. This guide covers how the fraud unfolds, the warning signs, prevention, and what to do if a transfer has already gone.

How payment diversion fraud works, step by step

The sequence is usually the same.

1. Reconnaissance. The fraudster learns who you pay, who pays you and when. Their sources: your website, public company records, social networks, sometimes a compromised mailbox.
2. A sending address. Either they take over a real mailbox (a stolen password, no multi-factor authentication), or they register a lookalike domain such as dupont-imm0.fr or dupont-immo-invoice.com for a business that uses dupont-immo.fr.
3. The timing. The message arrives when a payment is expected: an invoice due date, a rent collection, a deposit, the balance of a sale. The amount and the context are right; only the bank details have changed.
4. The pretext and the pressure. A change of bank, an audit, a frozen account. The tone is urgent: the payment must go today, the usual contact is unavailable, the old account must no longer be used.
5. The replies are captured. When the victim asks a question, the fraudster answers. Replies sent to a lookalike domain land in a mailbox they control. In a compromised account, forwarding or filtering rules can hide the conversation from its real owner.
6. The transfer. The money leaves for the new account and is moved on quickly. The fraud often surfaces only when the genuine supplier chases an unpaid invoice.

Compromised mailbox or lookalike domain

The two routes call for different defences. With a compromised mailbox, the email really comes from your supplier's address or your own: every technical check passes, and only a callback procedure catches the fraud. With a lookalike domain, the address is close to the real one but different, and that difference can be detected before and after the email is sent.

Businesses that collect recurring payments from many clients, such as letting agencies, are particularly exposed: see our guide on rent payment fraud.

Exact-domain spoofing versus lookalike domains: what DMARC can stop

Two techniques are often confused. Exact-domain spoofing means forging the sender address of your real domain: the message claims to come from accounts@dupont-immo.fr without going through your servers. A lookalike domain is a different domain, registered by the fraudster, that a hurried reader takes for yours.

From: Accounts <accounts@dupont-immo.fr>     exact domain, forged: blocked by DMARC p=reject
From: Accounts <accounts@dupont-imm0.fr>     lookalike (zero instead of o): passes its own checks
From: Accounts <accounts@dupont-immo.com>    lookalike (other extension): passes its own checks

DMARC is a DNS record that tells receiving servers what to do with messages that use your domain but fail authentication (SPF and DKIM). At p=reject, receiving servers that apply DMARC refuse forged messages sent in your name. Every business should get there: our guide to DMARC p=reject explains the steps from p=none.

Against a lookalike domain, DMARC on your domain can do nothing. The fraudster owns dupont-imm0.fr, can publish their own SPF, DKIM and DMARC records, and their emails pass authentication. The only answers are to detect the lookalike, ideally before it is used, and to have it taken down by the registrar or the hosting provider. Our guide to detecting lookalike domains shows how they are built.

Warning signs of a bank details change scam

No single sign proves fraud, but each one is a reason to stop and verify before paying.

• A request to change bank details, especially close to a payment date or for a large amount.
• Urgency or secrecy: pay today, do not call, the usual contact is travelling, the old account is frozen.
• A sender address that differs by one character, a different extension or an added word (dupont-immo-payment.fr, dupont-imm0.fr, dupont-immo.com).
• A Reply-To address that differs from the From address: your answer would go somewhere else.
• An account holder name that does not match the business, or an IBAN whose country code does not match where the supplier is based.
• A name-check warning from your bank when you add the new payee (Confirmation of Payee in the UK, verification of payee for euro transfers in the EU).
• A new PDF invoice or bank details letter that copies the usual layout, with only the bank details changed.
• Changes in tone, signature or phone number compared with earlier messages.

A message that continues a real conversation is not proof that it is genuine. A fraudster who has read the thread, through a compromised mailbox on either side, can copy it word for word.

How to prevent payment diversion fraud

Prevention rests on a few rules that hold even when an email looks perfect.

Call back on a number you already know

Confirm any change of bank details by phone, on a number you had before the request arrived: the contract, a previous invoice, your supplier records. Never use the number in the email or its signature, which may lead straight to the fraudster. Describe the request you received and let your contact confirm or deny it, rather than asking whether everything is fine.

Require two people for any change of bank details

Changing a payee's bank details in your accounting or banking tool should take two people: one who records the change, another who checks the callback and approves it. Record who called whom, on which number and when. The rule applies to senior management too, which also protects against CEO fraud.

Write the procedure down and share it

Put the rule in writing and tell your clients and suppliers: you never change your bank details by email, and any change is confirmed through a channel they already know. Add it to your invoices, contracts and email signatures. A client who knows the rule has a reason to call you before paying a fake invoice.

Protect your own domain and mailboxes

Turn on multi-factor authentication for every mailbox, and check regularly for forwarding rules nobody remembers creating. Publish SPF and DKIM, then move DMARC to p=reject so that nobody can send emails in your exact name. The UK National Cyber Security Centre publishes practical guidance on email security.

Watch for lookalike domains

Lookalikes are registered in public, so they can be found. A free lookalike domain scan on Spamr generates several hundred variants of your domain (typos on AZERTY and QWERTY keyboards, lookalike characters including Cyrillic letters, other extensions, added words such as invoice or payment) and checks public DNS and registration data only, without visiting the sites. A lookalike registered recently with a mail server (MX record) deserves immediate attention: it can receive the replies to the emails it sends. It also checks your own SPF and DMARC.

Continuous monitoring adds a daily rescan and an email alert when a new lookalike appears, along with assisted takedown requests (see the monitoring plans).

What to do if you have already paid

Speed matters more than anything else. Act in this order.

1. Call your bank immediately, using the number on your card or in your banking app, and ask them to try to recall the transfer. Your bank can contact the receiving bank. Nothing is guaranteed, but the sooner you ask, the better your chances.
2. Keep all the evidence: the emails with their full headers (export them rather than forwarding them), the attachments, the bank details you received, the payment order and notes of your calls. Do not delete anything, even in a compromised mailbox.
3. Report it to the police. In France, file a complaint with the police or gendarmerie; Cybermalveillance.gouv.fr helps victims with advice and referrals. In the UK, report it to Report Fraud, the national service that replaced Action Fraud, or to Police Scotland if you are in Scotland.
4. Warn the real supplier or client and anyone else in the thread: they may be the next target, or the compromise may be on their side.
5. Find the entry point. For a mailbox: reset passwords, turn on multi-factor authentication, remove unknown forwarding rules and review recent sign-ins. For a lookalike domain: ask the registrar and the host to take it down, as explained in our guide to taking down a lookalike domain.
6. Talk to a lawyer and your insurer about your options and any cover you may have.

Key takeaways

• Payment diversion fraud needs only one email, sent at the right moment, with new bank details.
• Never accept a change of bank details by email alone: call back on a known number and have a second person approve it.
• DMARC at p=reject stops forgery of your exact domain, not lookalike domains.
• Lookalikes are public: detect them early and have the dangerous ones taken down.
• If money has left, call your bank first, then keep the evidence and report the fraud.