Invoice redirection fraud — sometimes called mandate fraud — works because the invoice itself is genuine. A criminal intercepts or impersonates a supplier and sends 'new' bank details. The goods or services were really delivered, so the payment looks routine. Only the destination account is wrong.
Why it slips through
Finance teams are trained to check that an invoice is valid, not that an IBAN belongs to the right company. A convincing email and a plausible reason ('we changed banks') is often enough. Without a name-vs-IBAN check, nothing in the workflow catches the swap.
The invoice is real — the account is not
That is what makes invoice redirection so effective. Verifying the payee name against the IBAN is the control that targets the one thing the fraudster had to change.
Where VoP intervenes
- 1 When new or changed bank details arrive, run a Verification of Payee check on the IBAN.
- 2 A 'no match' or 'close match' against the expected supplier name is a stop-and-verify signal.
- 3 Confirm changes through a known phone number, never the contact details on the suspicious email.
- 4 Log the VoP outcome against the payment for audit and dispute evidence.
Building the check into payments
The strongest defence is automatic: verify the payee whenever bank details are added or changed, not just at onboarding. RoxPay's Verification of Payee API makes that a single call you can wire into your AP workflow or banking app.