Payment diversion fraud: protect your business before the festive season

An email arrives from a supplier you have paid many times. It looks right: the usual contact, the usual signature, a reply to a real thread about a real invoice. It says the supplier has changed banks and asks you to pay this month’s invoice into the new account. You pay. Weeks later the supplier phones to ask why they have not been paid.

This is payment diversion fraud, also called business email compromise or invoice fraud. It needs no hacking skills on your side to fall for it, only a busy person and a convincing email. And the festive season gives criminals exactly that: year-end payment runs, staff on leave, people standing in for each other and pressure to pay suppliers before the shutdown.

How the scam works

Most cases follow the same pattern.

• A mailbox is compromised. The criminal gets into an email account, either yours or your supplier’s, usually through a phishing link or a reused password. Sometimes they register a lookalike domain instead, such as one letter changed in the supplier’s name.
• They watch and wait. The criminal reads correspondence quietly until a real invoice or payment is due, so the request arrives at a believable moment and in the right tone.
• The bank details change. A message or an edited invoice asks for payment into a “new” account, often with a reason: a change of bank, an account under audit, or a temporary arrangement.
• Detection is delayed. Criminals often set up rules in the compromised mailbox to hide replies, or intercept your proof of payment, which buys time to move the money on.

Because these emails often come from a real, compromised account, they can pass the spam and security checks your email system runs. There may be no attachment or link to warn anyone. The same method is used in fake “urgent payment” requests that appear to come from a director, and in requests to change an employee’s bank details before payroll.

Why the loss usually stays with the payer

Many businesses assume that if the supplier’s email was hacked, the supplier carries the loss. South African courts have not seen it that way.

• You may have to pay twice. In Intengo Imoto (Pty) Ltd v Zoutpansberg Motor Wholesalers CC (2025), the Supreme Court of Appeal held that an electronic payment only counts when the money reaches the creditor’s account. A buyer that paid into a fraudster’s account was not discharged from its debt and had to pay the full price. The court confirmed that the person paying carries the onus of proving that payment reached the creditor, and must take reasonable steps to confirm the correct account.
• The business whose emails were spoofed is not automatically liable. In Edward Nathan Sonnenbergs Inc v Hawarden (2024), the Supreme Court of Appeal overturned a High Court order that a law firm compensate a property buyer who paid R5.5 million into a fraudster’s account after her own email was hacked. The buyer had been warned and could have verified the bank details by phone, so the loss remained hers.

The practical message is simple: the controls that protect your money have to sit on your side of the payment.

The wider trend points the same way. SABRIC, the banking industry’s crime risk centre, reported R2.4 billion in digital banking crime losses for 2025, and that figure does not include business email compromise.

Eight controls that stop most payment diversion fraud

None of these needs expensive technology. They need clear rules that everyone follows, including the person standing in while someone is on leave.

1. Verify every change of bank details by phone

Phone the supplier on a number you already have on file, not one in the email, the invoice or the letter asking for the change. Speak to someone you know, and record who confirmed the change, when and on which number. Treat any request that discourages a call-back, or claims the usual contact is unavailable, as a red flag.

2. Separate changing the supplier master file from paying

The person who updates supplier bank details should not be the person who loads or releases payments. Keep a log of every change, and have someone review the log against the call-back records each month. Ask your bank whether it offers an account verification service that confirms the account holder before you pay.

3. Hold the first payment to a changed account

Do not release a payment to new bank details on the same day the change is requested. Where the amount is large, consider a small test payment that the supplier confirms before the balance is paid.

4. Require two people to load and release payments

Set up your business banking profile so that one person captures a payment and a second person authorises it, with sensible release limits. Make sure leave cover is planned in advance so that this rule does not get relaxed in December.

5. Know the red flags

Pause and verify when a payment request is urgent or confidential, comes at the end of the day or before a public holiday, names a bank or country you have not seen before for that supplier, or comes from an email address that is very slightly different from the usual one.

6. Protect your mailboxes

Switch on multi-factor authentication for email and online banking, remove access for people who have left, and ask your IT provider to check for unexpected forwarding or inbox rules. A short awareness session for everyone who handles invoices and payments is one of the most effective controls you can put in place.

7. Reconcile supplier statements and review bank statements monthly

Reconciling supplier statements to your creditors ledger every month shows quickly when a supplier says it has not been paid. An owner or director reviewing the bank statement every month, and querying unfamiliar beneficiaries, adds a second line of defence. Our audit-ready checklist for SMMEs sets out more controls that suit small finance teams.

8. Apply the same rules to payroll

Changes to employees’ bank details should be confirmed in person or through your HR or payroll system, never accepted from an email alone, especially in the weeks before salaries and bonuses are paid.

If it happens: act within hours

• Call your bank’s fraud line immediately. Speed matters: the sooner your bank contacts the receiving bank, the better the chance of stopping or recovering the money.
• Open a case with the South African Police Service and keep the case number for your bank and insurer.
• Tell the supplier using contact details you trust, so they can check their own systems.
• Preserve the evidence. Keep the emails, including their full headers, the invoices and the payment confirmations. Do not delete anything from the affected mailbox.
• Secure your systems. Reset passwords, switch on multi-factor authentication and have your IT provider check the mailbox for forwarding rules and unknown sign-ins.
• Check your obligations and your cover. If personal information may have been accessed, the Protection of Personal Information Act requires you to notify the Information Regulator and the people affected. Check whether your insurance covers the loss: many policies only respond if specific verification procedures were followed.

How we can help

Our Governance, Risk & Internal Controls team reviews payment and supplier master file controls and helps design procedures that suit the size of your finance team. Through HLB Advisory, our cyber security consultants can assess how well your email and systems are protected and run awareness sessions for staff. Our Consulting department helps clean up supplier data and set up monthly reconciliations, the same groundwork that will be needed for SARS e-invoicing.

Speak to our team about tightening your payment controls before the festive season.

This article provides general information only and is not legal advice. It refers to the Supreme Court of Appeal judgments in Intengo Imoto (Pty) Ltd v Zoutpansberg Motor Wholesalers CC (2025) and Edward Nathan Sonnenbergs Inc v Hawarden (2024), and to SABRIC’s 2025 annual banking crime statistics. Speak to your attorney, bank or insurer about your specific circumstances.