Invoice Manipulation: How to Protect Your Business from Fraud!

“I’ve already paid that,” is not the response you wanted when following up on the $150,000 invoice that is 30 days past due!  After a quick back and forth, your customer (and remember, the customer is always right) produces an email FROM YOU with new payment instructions.  As you review the email, a gigantic pit is forming in what was your stomach five minutes ago.  Your customer paid $150,000 to someone and it was not you.

Recent surveys indicate that 40% of firms reported experiencing some form of invoice manipulation within the last 12 months.  For those firms experiencing a financial loss, the average was over $350,000.  AI is accelerating the difficulty at spotting these fraud attempts.  

A robust cyber policy can help you out here, with some caveats.

First, the invoice manipulation will usually need to be the result of an attack that infiltrates your network or corporate email to send fraudulent invoices that redirect payment to the attacker’s account. What if you were not hacked, but your customer fell for a totally fake invoice?  In this case, it will depend on how broadly your policy defines invoice manipulation.  This would be a “social engineering” or masquerading loss for your customer’s Cyber policy. 

Second, there is usually a sublimit that will apply to an invoice manipulation claim—usually around $250K.  Your typical cyber policy is not going to offer full limits for such a loss.

Even if you purchase the most robust cyber risk policy on the market, here are some steps you should take to avoid falling prey to invoice manipulation.

1. Require “Out-of-Band Phone Verification” for any change in payment instructions.

   
   

   Never trust an email or digital message announcing a bank account or routing change. Always call the vendor using a known, pre-verified phone number from your original contract or their official website—never the contact number listed on the suspicious invoice.

   
   

2. Separation of duties within your accounting team.

   
   

   Make sure that no single employee can onboard a vendor, approve an invoice, and disburse funds unilaterally.

   
   

3. Enlist AI and automation tools to help you spot fraudulent activity.

   
   

   The bad guys are putting it to use, you might as well make it work for you!