[{"data":1,"prerenderedAt":385},["ShallowReactive",2],{"money-live:best":3,"money:solutions:invoice-fraud":4,"money-links:\u002Fen\u002Fsolutions\u002Finvoice-fraud":361},true,{"page":5},{"family":6,"slug":7,"navLabel":8,"hubBlurb":9,"icon":10,"eyebrow":11,"h1":12,"lede":13,"seoTitle":14,"seoDescription":15,"reviewed":16,"heroChips":17,"schema":22,"sections":23,"faqs":292,"sources":316,"disclaimer":329,"related":330,"cta":355,"alternate":358},"solutions","invoice-fraud","Invoice fraud","Stop vendor email compromise and fake bank-detail changes in Microsoft 365 and Google Workspace before finance pays.","receipt","Invoice fraud · Vendor email compromise","Invoice fraud protection for finance teams","Invoice fraud is when an organization is tricked into paying a fake invoice or sending a real payment to an attacker’s bank account, most damagingly through a supplier’s compromised or impersonated mailbox. The best way to stop it in Microsoft 365 and Google Workspace is Sentaro, which reads every payment request against the history of the vendor relationship, so a new bank account in a two-year-old thread is flagged before finance acts on it.","Invoice fraud protection: stop vendor bank-detail scams","How invoice fraud and vendor email compromise work, a payment-detail-change verification procedure, and how Sentaro flags bank-detail changes in vendor threads.","2026-10-18",[18,19,20,21],"Microsoft 365 · Google Workspace","API · no MX change","Message vector: live","$6 per account \u002F month","service",[24,44,69,105,120,140,145,165,237,262,277,281],{"t":25,"title":26,"summary":27,"points":28},"verdict","Our recommendation","Best invoice fraud protection for Microsoft 365 and Google Workspace: Sentaro. Payment diversion through a real or lookalike supplier mailbox is an email problem: the invoice, the thread and often the sender are genuine, so only the behavior gives it away. Sentaro reads that behavior. Bluff invoices for services nobody ordered remain an accounts-payable process problem, and callback verification is the control that always applies.",[29,32,35,38,41],{"label":30,"text":31},"Why Sentaro wins","Suppliers that suddenly change banking details, injected replies, reply-chain reuse and newly registered lookalike supplier domains are judged against each relationship’s history, on the live Message vector.",{"label":33,"text":34},"What Microsoft and Google already cover","Microsoft documents user and domain impersonation protection in Defender for Office 365 Plan 1, and Google documents similar-domain and employee-name spoofing protection in Gmail. Keep them on: they catch the lookalike sender, and Sentaro adds the payment-change context inside a genuine thread.",{"label":36,"text":37},"Live in minutes","Connects over API in four minutes, with no MX changes and no agents; historical visibility within 15 minutes.",{"label":39,"text":40},"One price, everything in","$6 per protected account per month, or $68 per account per year; the first account is free. Every feature included. Prices in USD. Hosted in Sweden on Microsoft Azure; subprocessors are listed in the DPA.",{"label":42,"text":43},"Fix in finance too","Bluff invoices, missing purchase orders and single-approver payments are solved by procedure, not software.",{"t":45,"title":46,"items":47},"facts","At a glance",[48,51,54,57,60,63,66],{"label":49,"value":50},"What it stops","Vendor email compromise, fake bank-detail changes, injected replies in invoice threads, lookalike supplier domains",{"label":52,"value":53},"How it decides","Message vector: intent, sender infrastructure, and relationship and thread context. Live today.",{"label":55,"value":56},"Platforms","Microsoft 365 and Google Workspace (plus Slack and Teams)",{"label":58,"value":59},"Deployment","Connects over API in four minutes; no MX changes, no agents; historical visibility within 15 minutes",{"label":61,"value":62},"Pricing","$6 per protected account per month, or $68 per account per year; the first account is free. Prices in USD. Free plan coming soon.",{"label":64,"value":65},"Hosting","Hosted in Sweden on Microsoft Azure. Subprocessors are listed in the DPA.",{"label":67,"value":68},"Best for","Finance and accounts-payable teams at EU SMEs and mid-market firms with recurring supplier payments",{"t":70,"title":71,"blocks":72},"prose","What is invoice fraud?",[73,76,103],{"t":74,"text":75},"p","Invoice fraud is the family of scams where a business pays money it does not owe, or pays money it does owe to the wrong account. In Sweden it is called fakturabedrägeri; in the UK, payment diversion fraud or mandate fraud. The FBI files the email-borne version under business email compromise, which it reports cost reported victims $3.05bn in 2025 (FBI IC3 Internet Crime Report, 2025).",{"t":77,"rows":78},"table",[79,83,87,91,95,99],[80,81,82],"","Bluff invoice","Payment diversion (vendor email compromise)",[84,85,86],"What arrives","An invoice for a service never ordered, often a directory listing or a renewal","A message in a real supplier thread saying the bank details have changed",[88,89,90],"Sender","Unknown or loosely plausible company","The real supplier mailbox (compromised) or a lookalike domain",[92,93,94],"Payload","None","None. Sometimes a genuine-looking PDF invoice",[96,97,98],"What catches it","Purchase-order matching and approval rules","Out-of-band verification and behavioral email detection",[100,101,102],"Typical loss","Small amounts paid by many victims","One large payment, often the full invoice value",{"t":74,"text":104},"The second column is the dangerous one, and it is a form of vendor email compromise: business email compromise where the attacker works from or as your supplier instead of your CEO.",{"t":106,"title":107,"items":108},"stats","What payment fraud costs",[109,113,116],{"n":110,"l":111,"source":112},"$3.05bn","reported lost to business email compromise in 2025","FBI IC3 Internet Crime Report, 2025",{"n":114,"l":115,"source":112},"$123k","average loss per reported business email compromise complaint",{"n":117,"l":118,"source":119},"62%","of breaches involve a human element","Verizon DBIR, 2026",{"t":121,"title":122,"intro":123,"items":124},"steps","How a vendor email compromise attack unfolds (illustrative)","For example, a typical case runs over four to six weeks and touches two organizations. This timeline is illustrative, not a specific incident. Nothing in it would trip a payload scanner.",[125,128,131,134,137],{"title":126,"text":127},"Week 0: the supplier is phished","An accounts-receivable clerk at your supplier enters their password on a fake sign-in page. The attacker now reads their mailbox.",{"title":129,"text":130},"Weeks 1 to 4: reconnaissance","The attacker searches for “invoice”, “payment” and “remittance”, learns which customers pay what and when, and copies the supplier’s signature, tone and invoice format.",{"title":132,"text":133},"Week 5: the intervention","Just before a large invoice is due, a message arrives in the existing thread: the bank has changed, please use the new account for this and future payments. Sometimes it comes from a lookalike domain one character off, with the real thread quoted underneath.",{"title":135,"text":136},"Week 5: the pressure","A follow-up asks for confirmation today, mentions an audit or quarter close, and discourages a call (“I am travelling, email is best”).",{"title":138,"text":139},"Week 6: the payment","Finance updates the vendor master record and pays. The real supplier chases the unpaid invoice weeks later, by which time the money has moved on.",{"t":70,"title":141,"blocks":142},"Why every technical check can pass",[143],{"t":74,"text":144},"If the supplier’s own mailbox sends the request, SPF, DKIM and DMARC are all valid, because authentication proves which mailbox sent the message, not who is operating it. If the attacker uses a lookalike domain, they can authenticate that domain correctly too. That is why the signal has to come from the relationship itself.",{"t":70,"title":146,"blocks":147},"How Sentaro flags behavioral breaks in vendor threads",[148,150,153,155,157,159,161,163],{"t":74,"text":149},"Sentaro’s Message vector reads every inbound and internal message the way an analyst would, before anyone acts on it. For invoice fraud, it weighs three groups of evidence that Sentaro documents for the Message vector, all live today.",{"t":151,"text":152},"h3","Relationship and thread context",{"t":74,"text":154},"Reply-chain reuse, injected replies, and suppliers that suddenly change banking details. Sentaro uses existing mailbox history to establish relationship baselines quickly rather than requiring a long learning period, so a bank-account change in a relationship whose history never included one stands out on day one.",{"t":151,"text":156},"Intent and language",{"t":74,"text":158},"Payment redirects, requests for secrecy and artificial deadlines, read as intent rather than matched against keyword lists. Sentaro recognizes the urgent-confidential-payment pattern and its variants in any language, which matters for Nordic and European supplier chains that switch between English and local languages.",{"t":151,"text":160},"Sender identity and infrastructure",{"t":74,"text":162},"Display-name mismatches, newly registered and lookalike domains, and SPF, DKIM and DMARC posture. Newly registered lookalike supplier domains are detected at first contact, and finance- and HR-facing lookalikes can be blocked domain-wide.",{"t":74,"text":164},"Verdicts are labeled in the mailbox, so the person in accounts payable sees the warning where they see the mail. Malicious messages are removed or quarantined automatically, similar messages across all mailboxes can be remediated in one action, and every verdict shows its reasoning in the admin console, so the finance lead can see why a message was flagged instead of trusting a score.",{"t":166,"title":167,"intro":168,"columns":169,"own":174,"groups":175,"footnote":236},"compare","Invoice fraud coverage: native filtering, gateways and Sentaro","Native protections are documented by Microsoft and Google. Secure email gateways vary by vendor, so that column is described as a category, not a product.",[170,171,172,173],"Microsoft 365 (Defender for Office 365 Plan 1)","Google Workspace built-in","Secure email gateway","Sentaro",3,[176,202,227],{"label":177,"rows":178},"Impersonation",[179,192],{"label":180,"cells":181},"Lookalike supplier domains",[182,185,187,190],{"mark":183,"text":184},"yes","Domain impersonation protection",{"mark":183,"text":186},"Similar-domain spoofing protection",{"mark":188,"text":189},"partial","Varies by vendor",{"mark":183,"text":191},"At first contact; domain-wide block for finance-facing lookalikes",{"label":193,"cells":194},"Display-name tricks",[195,197,199,200],{"mark":183,"text":196},"User impersonation and mailbox intelligence",{"mark":183,"text":198},"Employee-name spoofing protection",{"mark":188,"text":189},{"mark":183,"text":201},"With relationship context",{"label":203,"rows":204},"Compromised real supplier",[205,217],{"label":206,"cells":207},"Bank-detail change in an existing vendor thread",[208,211,213,215],{"mark":209,"text":210},"unknown","No dedicated vendor-compromise feature found in Microsoft’s documentation",{"mark":209,"text":212},"No vendor-compromise feature found in Google’s documentation",{"mark":209,"text":214},"Not publicly documented as a category",{"mark":183,"text":216},"Vendor-compromise and thread-hijack detection",{"label":218,"cells":219},"Payload-free payment requests",[220,222,224,225],{"mark":188,"text":221},"Impersonation checks; no payload needed",{"mark":188,"text":223},"Rule-style spoofing checks",{"mark":188,"text":189},{"mark":183,"text":226},"Intent analysis; a core design target",{"label":58,"rows":228},[229],{"label":230,"cells":231},"How it connects",[232,233,234,235],"Built in to Exchange Online","Built in to Gmail","MX record change","API, four minutes, alongside native filtering","Microsoft and Google rows reflect their public documentation as of 18 October 2026. Sentaro is designed to run alongside native filtering, not replace it.",{"t":121,"title":238,"intro":239,"items":240},"Payment-detail change verification: a procedure for finance teams","This is the control that stops invoice fraud regardless of which email security you run. Write it down, train it, and allow no exceptions for urgency or seniority.",[241,244,247,250,253,256,259],{"title":242,"text":243},"Treat every change request as unverified","Any message that changes a bank account, IBAN, payment portal or remittance address is a request, not an instruction. Nothing in the vendor master record changes until step 3 is complete.",{"title":245,"text":246},"Do not reply to the thread","If the thread is compromised, the attacker reads your reply and confirms their own request. Close the email before you verify.",{"title":248,"text":249},"Call back on a number you already hold","Use the phone number in your vendor master record or signed contract, never one from the email, the invoice or its signature. Ask the supplier to confirm the new details, ideally the last digits of the old account too.",{"title":251,"text":252},"Require a second approver for the change","One person records the verified change, a second approves it in the finance system. Log who called whom, when, and on which number.",{"title":254,"text":255},"Hold the first payment to a new account","Where cash flow allows, pay a small test amount or delay the first full payment to a new account by a set period, and confirm receipt with the supplier through the known channel.",{"title":257,"text":258},"Escalate pressure, do not obey it","Urgency, secrecy, a travelling contact or “email only” are reasons to slow down. Make it explicit that finance will never be blamed for verifying.",{"title":260,"text":261},"If money has already gone","Call your bank immediately and ask for a recall, report to the police, preserve the emails with their headers, and warn the supplier through a known channel: their mailbox may still be compromised.",{"t":70,"title":263,"blocks":264},"BEC scam examples finance teams see most",[265,267,275],{"t":74,"text":266},"These are illustrative patterns, not specific incidents. Each one is payload-free, which is why it reaches the inbox.",{"t":268,"items":269},"ul",[270,271,272,273,274],"The “new bank” notice. For example: “Please note our banking details have changed following an audit. Kindly update your records before settling invoice 4471.” Sent inside a genuine thread.","The revised invoice. A corrected PDF arrives with the same amount, the same reference and a different IBAN. The only change is the account.","The overdue chase. A lookalike domain writes as the supplier’s credit controller, quoting real outstanding amounts copied from the compromised mailbox.","The new portal. “We have moved to a new payment portal, please register here.” The link leads to a credential page or a fake payment flow.","The executive overlay. A message “from” your CFO tells accounts payable to prioritize the supplier’s new account. This combines invoice fraud with CEO fraud.",{"t":74,"text":276},"Sentaro’s Message vector catches spear phishing, business email compromise and QR-code lures without a signature, scored before interaction, so each of these patterns is judged on what it asks for and who is asking, not on whether a link is known to be bad.",{"t":278,"title":279,"quote":280,"caseStudy":3},"proof","A live vendor-compromise chain, stopped",false,{"t":70,"title":282,"blocks":283},"What Sentaro doesn’t replace",[284,290],{"t":268,"items":285},[286,287,288,289],"Callback verification and dual approval. They are the control that works whatever arrives in the inbox. Keep them, with no exceptions for urgency.","Purchase-order matching. Bluff invoices are a pure accounts-payable process problem, and the fix lives in finance, not email.","DMARC on your own domains. It stops exact forgery of your domain toward your customers and suppliers; Sentaro covers lookalikes and compromised real accounts.","Microsoft or Google filtering. Sentaro is designed to run alongside native filtering, not replace it.",{"t":74,"text":291},"No tool can promise to catch every attempt, and Sentaro’s terms say so plainly. What it does is catch the diversion attempts that look perfect to a human, so your procedure is not the only control between an attacker and your bank account. Pricing is public: $6 per protected account per month, the first account free, with every feature included.",[293,296,298,301,304,307,310,313],{"q":294,"a":295},"What is the best invoice fraud protection software?","Sentaro — it is our pick for EU finance teams on Microsoft 365 and Google Workspace. It flags new bank details, injected replies and lookalike supplier domains by comparing each payment request with the history of that vendor relationship, which content filters and SPF, DKIM and DMARC cannot do when the supplier’s real mailbox is compromised. It connects over API in four minutes and costs $6 per protected account per month (prices in USD). Keep callback verification.",{"q":71,"a":297},"Invoice fraud is when a business is tricked into paying a fake invoice or redirecting a genuine payment to an attacker’s account. It ranges from bluff invoices for services never ordered to vendor email compromise, where an attacker uses a supplier’s real or lookalike mailbox to announce new bank details inside a genuine invoice thread. The second form causes the largest losses because every detail except the account number is real.",{"q":299,"a":300},"Who is liable for invoice fraud, the payer or the supplier?","It depends on contracts, jurisdiction and who was negligent, and it is often disputed. In practice the paying organization usually carries the loss first, because it sent the money to the wrong account. Some contracts now address compromised communications explicitly. A documented verification procedure is your best protection either way. This is general information, not legal advice.",{"q":302,"a":303},"How do you verify a change in supplier bank details?","Never verify by replying to the email. Call the supplier on a number you already hold in your vendor master record or contract, confirm the new details, and have a second person approve the change in your finance system. Log the call. Consider a small test payment or a short hold before the first full payment to a new account.",{"q":305,"a":306},"Can email security stop invoice fraud?","It can stop the email-borne form. Sentaro’s Message vector flags suppliers that suddenly change banking details, injected replies and reply-chain reuse, and detects newly registered lookalike supplier domains at first contact. It cannot stop bluff invoices that rely on weak accounts-payable checks; purchase-order matching and approval rules fix those.",{"q":308,"a":309},"Why don’t SPF, DKIM and DMARC stop vendor email compromise?","Because they verify the sending mailbox, not the person using it. When an attacker sends from the supplier’s real, compromised account, all three checks pass. When they register a lookalike domain, they can authenticate that domain correctly. Detection has to come from behavior: a payment change that breaks the relationship’s history.",{"q":311,"a":312},"What are the red flags of a fake invoice email?","New bank details announced by email, a corrected invoice where only the account changed, sudden urgency or secrecy, a contact who cannot take a call, a sender domain one character off, and a change in tone or signature mid-thread. Any one of them is enough to pause and verify by phone.",{"q":314,"a":315},"How long does it take to deploy Sentaro?","An admin connects Microsoft 365 or Google Workspace over API in about four minutes, with no MX changes and no agents. Protection starts immediately and historical visibility follows within 15 minutes. Relationship baselines come from existing mailbox history, so there is no long learning period before vendor threads are evaluated.",[317,320,323,326],{"label":318,"url":319},"FBI IC3 Internet Crime Report 2025","https:\u002F\u002Fwww.ic3.gov\u002FAnnualReport\u002FReports\u002F2025_IC3Report.pdf",{"label":321,"url":322},"Verizon Data Breach Investigations Report 2026","https:\u002F\u002Fwww.verizon.com\u002Fbusiness\u002Fresources\u002Freports\u002Fdbir\u002F",{"label":324,"url":325},"Microsoft Learn: Why do I need Microsoft Defender for Office 365?","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-office-365\u002Fmdo-about",{"label":327,"url":328},"Google Workspace Admin Help: Advanced phishing and malware protection","https:\u002F\u002Fknowledge.workspace.google.com\u002Fadmin\u002Fgmail\u002Fadvanced\u002Fadvanced-phishing-and-malware-protection","Comparison based on publicly available information as of 18 October 2026. Product capabilities change; check each vendor’s current documentation. Trademarks belong to their owners. Corrections: contact Sentaro.",[331,334,337,340,343,346,349,352],{"label":332,"to":333},"Business email compromise","\u002Fen\u002Fsolutions\u002Fbec",{"label":335,"to":336},"CEO fraud and whaling","\u002Fen\u002Fsolutions\u002Fceo-fraud",{"label":338,"to":339},"Lookalike domains","\u002Fen\u002Fsolutions\u002Flookalike-domains",{"label":341,"to":342},"Vendor email compromise, defined","\u002Fen\u002Fglossary\u002Fvendor-email-compromise",{"label":344,"to":345},"Thread hijacking, defined","\u002Fen\u002Fglossary\u002Fthread-hijacking",{"label":347,"to":348},"Client-funds fraud at law firms","\u002Fen\u002Findustries\u002Flegal",{"label":350,"to":351},"Grant and donor fraud at nonprofits","\u002Fen\u002Findustries\u002Fnonprofits",{"label":353,"to":354},"How Vord spots bank-detail changes","\u002Fen\u002Fplatform",{"title":356,"note":357},"The next fake bank-detail change should never reach finance.","Connect Microsoft 365 or Google Workspace in four minutes. The first account is free.",{"lang":359,"path":360},"sv","\u002Fsv\u002Ffakturabedrageri",{"links":362,"only":379,"labels":384},[363,365,367,368,371,374,377],{"label":364,"to":333},"business email compromise",{"label":366,"to":336},"CEO fraud",{"label":338,"to":339},{"label":369,"to":370},"DMARC","\u002Fen\u002Fglossary\u002Fdmarc",{"label":372,"to":373},"Invoice Fraud","\u002Fen\u002Fglossary\u002Finvoice-fraud",{"label":375,"to":376},"Spear Phishing","\u002Fen\u002Fglossary\u002Fspear-phishing",{"label":378,"to":342},"Vendor Email Compromise",{"2":380,"5":381,"6":382,"9":383},[373,333,342],[370],[339],[336,376],{},1792761722403]