Validitool

Guides · Updated 10 October 2026

Fake invoices and changed bank details: how to spot supplier fraud

The warning signs of invoice and payment-redirection fraud, and the checks that catch it before money leaves your account.

How the fraud works

The most common version is simple. You receive an email that seems to come from a supplier you already pay: their bank details have changed, please pay this invoice, and future ones, to the new account. The email may come from the supplier's real mailbox, taken over by the fraudster, or from a domain that looks almost the same. The invoice is often genuine, copied from a real one, with only the bank details changed.

A second version is the fake supplier: an invoice from a company that looks real, with a real-looking VAT number, for goods or services nobody ordered.

Once the money reaches the fraudster's account it is usually moved on within hours, and banks often can't get it back.

Warning signs

The checks that catch it

  1. Confirm every bank detail change by phone, using a number you already have on file, never one from the email or the new invoice. This one step stops most of these frauds.
  2. Use your bank's payee name check. Confirmation of Payee in the UK, and Verification of Payee for euro transfers in the EU since October 2025, tell you whether the account name matches the name you're paying.
  3. Check the IBAN. The IBAN checker confirms the IBAN is well formed and shows its country and bank code. An account in a country your supplier has nothing to do with is a red flag. It can't tell you who owns the account; only the bank's payee check can.
  4. Check the VAT number against the name. On the VAT checker, enter the company name you expect next to the number. A valid number that is registered to a different company is a classic fake-invoice set-up, and the check flags it wherever the country publishes the registered name.
  5. Look closely at the sender's domain. Compare it letter by letter with the one you know, and be wary of domains registered only weeks ago.

Automating the domain check

Validitool's email domain check (API, all plans) looks at an email address or domain and reports what's suspicious: a lookalike of the supplier's domain you already know, a domain registered in the last few months, a throwaway or free mailbox, a domain that can't receive email, and weak email security (SPF and DMARC) that lets anyone send mail that appears to come from it. The compliance check runs it alongside the VAT, EORI and sanctions checks when you take on a new supplier.

None of these checks replaces a phone call to someone you know. They are there to make the moment to pick up the phone obvious.

Check a supplier’s VAT number and name

Free, no sign-up needed for a few checks a day.

This guide is general information, not tax or legal advice. Rules and their application differ by country and by transaction; check with an adviser for your situation.

More guides