VETERAN-OWNED · NEBRASKA-BASED
A fake invoice email doesn't need malware or a bad link. It needs a busy accounts payable desk, a vendor you already pay, and a polite note saying the bank account changed. That's vendor payment-change fraud, a form of business email compromise that hits offices in Lincoln, Omaha, and across Nebraska.
This post is about the AP side: why these emails get paid, the callback and two-person habits that stop them, and the Microsoft 365 and Google Workspace settings that make them harder to pull off. For the general picture, start with our business email compromise guide. For how the attacker sets it up, see how invoice fraud works. This isn't legal advice.
Why these emails get paid
Fake invoice emails usually aren't clever. They're timed.
They show up at month-end, the week before payroll, or when the person who usually approves payments is out. In a lot of Nebraska offices one person handles AP, answers the phone, and fixes the printer. They're paying a stack of bills between other jobs, and a vendor email that says "we've switched banks, please update our ACH info" looks like one more piece of paperwork.
A few things make it believable:
- The vendor is real and you pay them regularly.
- The amount matches what you'd expect, or it's a past-due balance you half remember.
- There's a new remittance PDF or W-9 attached, on letterhead that looks right.
- There's a reason to hurry: a late fee, a shipment on hold, a job that can't start until the account is current.
- Sometimes it's a reply in a thread you've had with that vendor for months.
That last one matters. If the vendor's own mailbox was compromised, the email really did come from them. Checking the sender's domain won't catch it. Only your process will.
What it looks like in a Lincoln or Omaha office
A contractor in Lincoln gets a change request from a material supplier right before a big draw goes out. A clinic in Omaha gets one from a lab or billing vendor. A small agency gets one from a freelancer they pay every two weeks. Different businesses, same move: change where the money goes, and do it when nobody has time to ask questions.
The details vary. The ask doesn't. Somebody wants you to pay a familiar bill into an unfamiliar account.
The callback rule
When any vendor asks to change bank details, the AP person calls that vendor before anything gets updated. That's the whole rule, but how you call matters.
Call a number you already had: the one in your vendor file, on a signed contract, or on an invoice you paid before this request showed up. Never call the number in the new email, the email signature, or the attached PDF. If the email is fake, that number rings someone who will happily confirm the fake account.
When you get the vendor on the phone, don't read them the new account number and ask if it's right. Ask whether they requested a change, and have them tell you the details. Then write down who you spoke with, the number you called, and the time. It takes five minutes and it gives the next person something to check.
If the vendor says they never asked for a change, you've caught one. Don't reply to the email. Let the vendor know their mailbox may be compromised, and look at the what to do if you suspect BEC guide for next steps on your side.
Two people, every time
The callback is the big one. Dual approval covers the days someone is rushed, new, or out sick.
Keep it simple:
- One person enters a bank change or new payee. A different person approves it before it's saved.
- Bank changes only come in one way, such as a signed form verified by phone. An email alone never counts.
- The first payment to a changed account gets a second look, and you confirm with the vendor that it landed before the next one goes out.
- Nobody gets to skip the rule because the owner is traveling, the vendor is upset, or it's "just this once." Urgency is the reason the rule exists.
Write it down on one page and give it to whoever touches payments, including the bookkeeper who comes in two days a week. If you use QuickBooks, a bank portal, or a payroll service, check whether it can require a second approver on new payees or changed accounts and turn that on.
Mailbox hygiene in Microsoft 365 and Google Workspace
Process does most of the work, but your email setup decides how often AP gets tested and whether your own mailbox becomes the source of the next fake invoice.
Here's what we'd check first in either platform:
- MFA on every mailbox, especially anyone who sends or approves payments. A finance mailbox with just a password is the easiest way into the invoice threads.
- External sender warnings turned on where your platform supports them, so a message from outside the company is easy to spot. It won't stop a compromised vendor, but it helps with look-alike domains pretending to be someone inside your office.
- Automatic forwarding to outside addresses blocked or alerted. Microsoft 365 and Google Workspace both let an admin control this.
- Inbox rules and filters reviewed on a schedule. A rule that quietly forwards or hides invoice mail is a classic sign of a compromised mailbox. We wrote about that in the mailbox rule finance never sees.
- SPF, DKIM, and DMARC set up on your own domain, so it's harder for someone to send email that looks like it came from you. This protects your customers more than your AP desk, but it's worth doing.
- Sign-in alerts that someone actually reads, so a login from somewhere strange doesn't sit unnoticed while an attacker reads finance mail.
None of this replaces the callback. It cuts down how often your team has to make that call under pressure. For how we handle this for clients, see email security and cybersecurity.
If the money already went out
Call your bank first. Ask for their fraud department and ask about recalling the payment. Speed matters more than having every detail sorted out.
Then check the mailboxes on your side that touched the invoice, and tell the vendor so they can check theirs. Don't delete suspicious rules or emails to tidy up, because someone may need them later. The BEC what-to-do guide covers the first steps. If you have cyber insurance, your carrier will have its own reporting steps.
Lincoln, Omaha, and the rest of Nebraska
Fake invoice emails don't care about the county line. SAINT is based in Hickman. We work with offices in Lincoln and Omaha and around the state, mostly remotely, with on-site visits when they're needed.
So here's the question for your office: if a vendor emailed AP this afternoon asking to change their bank account, what would actually happen next? If the answer is "it depends who's working," that's worth fixing before it gets tested.
Talk to the team · 531-625-2111