1. A supplier emails new bank details. You:
Answer: Call them on the number from your records. Calling a known number is the single best defence.
2. The email comes from the supplier’s real address. So:
Answer: It could still be a hacked mailbox. Compromised real mailboxes are behind many invoice frauds.
3. Which domain is suspicious?
Answer: supplier-co.com instead of supplierco.com. Lookalike domains differ by a hyphen or one letter.
4. How should you verify new bank details?
Answer: By phone, using contacts from the contract. Replying goes back to the attacker.
5. An invoice is a bit higher than usual and marked urgent. That’s:
Answer: A red flag. Unexpected changes plus urgency deserve a check.
6. True or myth: small companies aren’t targeted.
Answer: Myth. Small companies are often targeted because they have fewer controls.
7. An invoice arrives for a service you don’t remember ordering. You:
Answer: Check whether it was actually ordered. Fake invoices rely on busy people paying without checking.
8. Who should handle changes to bank details?
Answer: Someone other than the person making payments. Separating duties means one person can’t be tricked into both steps.
9. What is “thread hijacking”?
Answer: A scammer replying inside a real email conversation. Attackers who gain mailbox access insert themselves into real threads.
10. A “vendor portal” email asks you to re-enter your login. You:
Answer: Go to the portal yourself. Fake portal emails steal credentials.