The weeks around a filing deadline are the worst possible time to ask a finance team to slow down. Invoices stack up, approvals queue, and half the department is chasing signatures or waiting on a document that should have arrived last Friday. Attackers count on exactly that. A fake invoice that lands on a busy Tuesday, wearing a vendor's logo and quoting a plausible purchase order number, does not need to be clever. It only needs to look like one more thing to process.

Invoice fraud is not a single trick. It is a family of tricks built around one weak point: the moment between "this looks normal" and "I approved it".

Why the tax window is prime time for fraud

Three things change between January and April, and all three work in the attacker's favour. The volume of legitimate financial email goes up, so an extra message from an unknown address attracts less attention. New contacts appear out of nowhere — accountants, payroll providers, tax authorities, a supplier who needs a form signed. And people work faster, because there is more to do and less time to do it.

There is also a data angle. A mailbox compromised in March often sits inside documents full of personal and banking information: payroll files, vendor statements, signed authorisations. That makes the tax window valuable even to attackers who never ask for a single payment. They get the material for a convincing request later, when everyone has relaxed.

One more detail worth knowing: these campaigns are usually prepared well in advance. Domains that mimic a supplier's name are often registered and warmed up weeks before the email is sent, so the "new" address is not quite as new as it looks.

The four patterns that reappear every year

Vendor impersonation with a real invoice

The attacker sends an invoice that is genuinely close to one your supplier issued — same layout, same services, same reference numbers. The only material change is the bank account at the bottom. These are harder to catch than a clumsy fake, because the details around the payment instruction all check out.

Bank detail change requests

A short, polite email: the company has moved banks, please update the remit-to information before the next payment run. Sometimes it is followed by a phone call from someone claiming to be the supplier's new finance officer. The urgency is the point — update now, confirm later.

Authority and payroll impersonation

Messages that look like they come from a tax office, a payroll platform or an executive asking about a wire's status. These target the person who can act, not the system. They often include a form to complete and return.

Thread hijacking

Here the attacker has access to a real mailbox — often the supplier's. They reply inside an existing conversation, so the message inherits the trust of everything above it. Look closely and the reply-to address has quietly changed, or earlier recipients have been removed from the thread.

Red flags worth pausing on

None of these proves fraud on its own. Two or three together should stop the payment until someone verifies it.

• Bank details that differ from your vendor master record, even slightly.
• A reply-to address that does not match the display name or the domain of the sender.
• Lookalike domains: an extra letter, a hyphen, a different top-level domain, or a free mail service where you normally deal with a company address.
• Pressure phrasing — "before close of business", "to avoid service interruption", "final reminder".
• Invoice numbering that skips or repeats, or an invoice for a period you have already been billed for.
• A PDF whose payment details link to somewhere, rather than simply stating them.
• Generic greeting on a message that claims to continue a long relationship.
• Slight changes in tone, signature block or footer from the usual contact.
• Requests to copy in a colleague you have never heard of, or to keep the matter confidential.

Please update the remit-to details below and process before close of business today so we can keep the early-payment discount.

That sentence does real work for the attacker. It creates a reason to skip the call you would normally make.

Verification steps that hold up under deadline pressure

1. Stop the payment, not the process. You are not blocking an invoice, you are pausing one. Say so in the ticket so the vendor relationship stays intact.
2. Check the actual address, not the name. Open the message headers and read the sending domain. Display names are free to change.
3. Call the number you already have. Use the contact in your vendor record or your accounting system — never a number supplied in the suspicious email. If the supplier is small, this is a two-minute call.
4. Use a second channel for banking changes. A phone call to a known contact, confirmed in writing to the same address you have used before. A change of bank details should never be actioned from a single email.
5. Require two people on any change to payment details. One person spots an anomaly; two people catching the same anomaly is much less likely to be coincidence.
6. Match against the purchase order. If the invoice references a PO, confirm the amount, the period and the bank details against the original agreement.
7. Log the check. Note who verified, when, and on which number. If something goes wrong later, that record matters.

If money has already left

Speed matters more than tidiness here. Call your bank's fraud or payments line straight away and ask whether the transfer can be recalled or stopped, and follow up in writing. Then tell your security or IT team, because a mailbox rule or a stolen credential may still be active — forwarding rules and inbox rules that hide replies are common and easy to miss. Contact the real supplier on a number you trust so they can warn their other customers, and preserve the original email with full headers before anyone deletes it. Reporting the incident to the relevant authorities is usually a formal step, and your bank or legal adviser can tell you what applies to your organisation.

Make verification the boring default

The teams that handle this well do not rely on vigilance during their busiest month. They agree in advance with their main suppliers that bank details only change by phone, and they write that rule into the contract. They keep the vendor master record locked down so only one or two people can edit it. They put a short reminder in the accounts payable inbox signature: new bank details are always confirmed by phone. And they say it out loud in team meetings in February and March, when the pressure starts to build.

A fake invoice is designed to look ordinary. Your defence does not need to be clever either — just consistent. One phone call to a number you already trust beats any amount of careful reading.

Photo: Nataliya Vaitkevich / Pexels