MANUFACTURING / FINANCE DIRECTORS
The supplier was genuine. The new bank details weren't.
A convincing invoice scam can arrive in a real supplier conversation. See how the request becomes believable, where to interrupt it and which safeguards Finance and IT should agree.
A believable payment request, with one detail changed
Suppose Finance receives an email apparently continuing a familiar supplier conversation. It uses the expected contact name, relates to an outstanding invoice and says the supplier's bank details have changed before the next payment run.
What makes this convincing? The sender seems familiar. The timing makes sense. The invoice details match a real relationship. None of those details proves the bank account is legitimate if the email conversation has been compromised.
Three points where the fraud can be interrupted:
1. Pause the amendment. Don't update beneficiary details from an email request alone, even if it appears to be a reply in an existing conversation.
2. Verify separately. Contact the supplier using a previously validated phone number or known secure process, not a number printed in the request or attachment. Record who confirmed the change.
3. Apply independent approval and investigate the account. A second authorised person approves the amendment. If the email chain is suspicious, IT reviews unusual logins, mailbox rules and account access, while Finance holds the payment.
Completed outcome: In this scenario, the request remains on hold until the supplier confirms the genuine bank details using the independent route. The initial email is not sufficient authority to pay.
This has happened in a real Finance mailbox
The National Cyber Security Centre describes a case involving a charity, not a manufacturer. Criminals interfered with a Finance Manager's mailbox by creating a rule that diverted messages about payments, invoices and bank details. They altered invoice correspondence so a fraudulent account looked credible within a real supplier exchange.
The charity later found a payment had gone to a different account. Among the changes it made were independent telephone verification for new or changed bank details, stronger sign-in security and greater scrutiny of suspicious mailbox activity.
What an FD can use from this: A payment process can be sound on paper and still be undermined when somebody controls the communication channel. The protection is layered: Finance verification, separate authority and IT identity/email controls.
Make the payment-change process work on a busy Friday
Completed ownership table:
| Situation | Finance owner | IT or security owner |
|---|---|---|
| Supplier asks to change beneficiary | Pause the change; call the supplier via a trusted number; document the response | Available for escalation if correspondence is suspicious |
| Regular approver is unavailable | Use a named, authorised substitute; never bypass separation of duties | Confirm no unusual account access if the request is suspect |
| A suspicious payment may have been made | Contact the bank immediately; preserve the payment record and report via the approved process | Secure the affected account, investigate sign-ins/rules and preserve relevant evidence |
Takeaway: Make the decision repeatable when people are busy. A document nobody uses is not a safeguard.
What is the security spend actually buying?
Make UK and PwC reported that 55% of surveyed manufacturers planned to invest in defending against or responding to cyber disruption in 2026; 54% planned investment in recovering more confidently and quickly.
The financial case still needs a clear business outcome. Use a simple four-part decision: exposure we are reducing, control or service proposed, evidence it works, and cost of the remaining risk.
Consider two possible outcomes. A customer payment is delayed by several days but ultimately collected. That may change cash timing and create additional costs, not necessarily mean the entire invoice value is lost. A permanently uncollectable invoice is a different loss. Don't count the same impact twice in a business case.
Make UK and PwC Executive Survey 2026, page 15
| £50,000 order | Treatment |
|---|---|
| Shipped late and paid in full | Track the delay to cash and any financing effect separately |
| Overtime, expedited carriage and reconciliation cost £1,800 | Record £1,800 as incremental cost, where incurred |
| Cancelled at a 25% contribution margin | Estimate £12,500 of lost contribution before any further adjustments |
HOW ASSURED DIGITAL CAN HELP
Make Finance and IT safeguards work together
Assured Digital can help with the Microsoft email, identity and security controls that sit alongside a business's payment-approval process. Finance retains ownership of supplier verification and payment authority. We can work with your existing IT provider where appropriate.