Invoice fraud starts in a mailbox, long before it reaches accounts payable

It helps to walk through the sequence, because each step leaves a trace you can check for, and each one is a point where it can be stopped.

• Getting in. The usual route is a phishing page that captures a password, or increasingly an adversary-in-the-middle page that captures the whole signed-in session. Microsoft’s threat intelligence team has been clear that this isn’t a flaw in multi-factor authentication as such: because the session cookie is stolen, “the attacker gets authenticated to a session on the user’s behalf, regardless of the sign-in method.”
• Staying hidden. Next comes an inbox rule. Microsoft’s own alert guidance describes rules that move mail to “another less noticeable folder (like RSS)”, mark it as read, or forward messages containing keywords such as “invoice” to an outside account. In one campaign Microsoft documented, the rule simply said: for every email from a particular domain, “move the mail to Archive folder and mark it as read.”
• Watching. With replies hidden, the attacker reads live threads with suppliers or customers and waits for a payment that’s worth the effort.
• Diverting. Then comes the request to change bank details. It may come from the compromised mailbox itself, inside the existing thread, or from a lookalike domain the attacker has registered, with the real thread copied across so it reads naturally.
• Holding on. In a campaign Microsoft published in January 2026, the attacker also added their own phone as a one-time passcode method on the victim’s account, so a password change wouldn’t lock them out.

Read that list again from the fraudster’s side and the logic is obvious. The invoice is the last and least interesting step, and it’s the only one most businesses are trained to look at.

It’s worth being straight about the scale, because this is a subject where alarming figures travel faster than accurate ones.

• Losses are real, and falling. UK Finance’s Annual Fraud Report 2026 records £41.3m lost to invoice and mandate scams in 2025, down 4% on the year. Of that, £28.0m was on business accounts, down 13%, across 1,217 business cases. UK Finance describes the overall figures as the lowest loss and case totals it has ever reported for this category.
• Recovery is partial. UK Finance says 48% of invoice and mandate scam losses were returned to victims in 2025. For business accounts, £10.6m of the £28.0m came back.
• It’s widespread, and usually small. The government’s Cyber Security Breaches Survey 2025/2026 estimates that 3% of UK businesses, roughly 43,000, were victims of fraud resulting from a cyber breach or attack in the previous 12 months. The median perceived cost was £110.
• The front door is still email. The same survey found phishing “the most prevalent type of breach or attack by far”, reported by 38% of businesses, with impersonation at 12%.

Two honest caveats. The UK Finance figures only cover losses reported through its member banks, so they are a floor rather than a total. And a median of £110 tells you most incidents are small, not that yours will be. A single diverted supplier payment is limited only by the size of the invoice, which is exactly why the next section matters.

It’s tempting to believe that if the bank is told quickly enough, the money comes back. For most businesses that isn’t a safe assumption.

• Who is covered. The Payment Systems Regulator’s mandatory reimbursement rules, in force since 7 October 2024, apply to “individuals, microenterprises and charities”. A micro-enterprise means fewer than ten employees and an annual turnover or balance sheet no higher than €2 million. Charities qualify if their annual income is under £1 million.
• How much. Up to £85,000 per claim, with claims made within 13 months of the payment.
• Who isn’t. Any business outside those definitions. A 25-person firm that pays a fraudster’s invoice has no regulatory right to reimbursement, however fast it reports it.
• What’s changing. The PSR is being merged into the Financial Conduct Authority. The government has committed to carrying the reimbursement regime across, and as at the time of writing nothing has changed about who it covers.

Confirmation of Payee helps, but it has limits worth knowing. It checks that the name you’ve entered matches the name on the account. Pay.UK itself says it “does not automatically guarantee that a fraudulent payment will be detected”, and Barclays warns that “the account name might even match the intended payee”. A match tells you the account belongs to the name you typed. It doesn’t tell you the request to pay it was genuine.

So for most businesses above micro size, prevention is the only protection there is. That’s an uncomfortable conclusion, but it’s the accurate one.

Microsoft publishes a list of activities that can indicate a compromised mailbox, and it reads like a checklist for this exact attack. These are the ones that matter most for invoice fraud.

• Inbox rules nobody remembers creating, particularly rules that forward to unknown addresses or move messages to the Notes, Junk Email or RSS Subscriptions folders.
• Recently added external forwarding on a mailbox.
• Missing or deleted email, or unexpected items in Sent Items or Deleted Items.
• A changed email signature, which Microsoft specifically flags, including fake banking signatures.
• Changes to the user’s contact details in the Global Address List.
• Unexplained lockouts or frequent password changes.
• A new authentication method registered on the account, such as an unfamiliar phone.

Rules deserve a closer look, because they’re easy to miss. Not every rule shows up in the user’s own view, which is why Microsoft’s investigation guidance runs Get-InboxRule with the -IncludeHidden switch. If a supplier ever tells you they replied and your colleague never saw it, the rules are the first place to look.

Speed matters on two fronts at once: the bank and the tenant. Do both in parallel, not one after the other.

• Ring your bank immediately, using the number on the back of your card or on your bank’s website, never a number from the email. The sooner a payment is flagged, the better the chance of stopping or recovering it.
• Disable the affected account, or reset its password, following the order in Microsoft’s guidance on responding to a compromised email account. Don’t send the new password by email.
• Revoke the user’s sessions. Microsoft’s guidance uses Revoke-MgUserSignInSession to invalidate refresh tokens. Access tokens already issued can remain valid for up to an hour by default, so treat the first hour as live.
• Review the account’s registered MFA methods and remove anything the user doesn’t recognise.
• Review app consents and admin roles held by the account.
• Check and remove forwarding and inbox rules, including hidden ones.
• Update any app passwords. Microsoft notes they “aren’t automatically revoked when you reset the password.”
• Then investigate. Sign-in logs, the audit log and a message trace of what the account sent will tell you whether any supplier or customer received a fraudulent request from you, and whether you need to warn them.
• Report it. Report Fraud replaced Action Fraud in December 2025 for England, Wales and Northern Ireland, on 0300 123 2040 or at reportfraud.police.uk. In Scotland, report to Police Scotland on 101.

The step that’s easiest to skip is session revocation, and it’s the one that matters. Microsoft’s January 2026 research on a multistage phishing and fraud campaign states plainly that “password resets alone are insufficient”, because a stolen session doesn’t depend on the password.

This is the part most checklists leave out, and it’s the one worth doing today, before anything has gone wrong.

Every step of the investigation above depends on logs. Microsoft’s documentation opens by saying audit logging is on by default for Microsoft 365 organisations, then adds, in an Important box on the same page, that “auditing isn’t enabled by default for Small and Medium Business (SMB) licenses, including Microsoft 365 Business Basic, Business Standard, and Business Premium.” Those are the licences most UK small businesses run on.

• To check it, an administrator runs Get-AdminAuditLogConfig | Format-List UnifiedAuditLogIngestionEnabled in Exchange Online PowerShell. True means auditing is on.
• To turn it on, run Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true. Microsoft says it can take up to 60 minutes to take effect, and it isn’t retrospective.
• Know your window. Audit (Standard) records are kept for 180 days, up from 90 days for records generated since 17 October 2023. Audit (Premium) keeps Exchange, SharePoint, OneDrive and Entra records for a year.
• Know what’s recorded. Microsoft’s documentation says the MailItemsAccessed action, which shows which messages were opened, is enabled by default for users with Office 365 or Microsoft 365 E3 and E5 licences. Whether it’s on by default for Business Premium isn’t stated, so check rather than assume.

A log that was never switched on can’t be switched on afterwards. If you find yours is off, turning it on is a one-line fix, and you’ve just saved yourself from the worst possible version of this incident.

Prevention works in layers, and the cheapest layers are process rather than technology.

• A payment verification rule with no exceptions. The NCSC’s advice is that important email requests should be verified “using a second type of communication”, such as a phone call. The detail that matters is using contact details you already hold, not the ones in the email. A change of bank details is never approved by reply.
• Tell your suppliers and customers how you work. The NCSC suggests telling them, for example, that “our bank details will not change at any point”. It turns your own staff into the last line of defence for other people’s businesses too.
• Explicitly block automatic external forwarding. The default outbound spam setting in Exchange Online, “Automatic – System-controlled”, now behaves as off for most tenants, but Microsoft notes that older tenants already using it may still allow forwarding, and recommends setting it to On or Off explicitly. Set it to Off.
• Phishing-resistant sign-in for finance and admin accounts. Microsoft’s recommended response to session theft is phishing-resistant methods such as FIDO2 security keys and passkeys, Windows Hello for Business, or certificate-based authentication, which Entra ID can require through a Conditional Access authentication strength. Our post on multi-factor authentication covers the difference between methods, and the Microsoft 365 password spray attack post covers where Conditional Access usually leaks.
• Alerting on inbox rule changes. Mailbox auditing records UpdateInboxRules by default for mailbox owners, so the signal exists. What’s usually missing is anybody looking at it.

Notice what isn’t on the list. SPF, DKIM and DMARC stop criminals sending mail that pretends to be your domain, and they’re worth doing, but they do nothing about a request sent from a supplier’s genuinely compromised mailbox. Every authentication check passes, because nothing is being faked.

Most of what goes wrong here is ordinary, which is the encouraging part.

• Mistake: resetting the password and calling it fixed. Without revoking sessions and checking the account’s MFA methods, the attacker can still be signed in.
• Mistake: deleting the malicious rule before recording it. Screenshot or export the rule and the relevant sign-in entries first. They’re evidence for the bank, the police and your insurer.
• Mistake: assuming the bank will refund you. Unless you’re a micro-enterprise or a small charity, the mandatory reimbursement scheme doesn’t apply.
• Mistake: treating a Confirmation of Payee match as approval. It confirms a name on an account. It doesn’t confirm the request.
• Mistake: only warning the finance team. Anyone whose mailbox touches suppliers, customers or quotes is a useful target, including sales and operations.
• Pro tip: run the audit log check this week. It takes a minute and it’s the difference between an investigation and a guess.
• Pro tip: after any compromise, tell the people the account emails most. If the attacker sent fraudulent requests from your mailbox, your customers are the ones about to lose money.
• Pro tip: pair the technical controls with training. Our post on security awareness training covers how to make a payment verification habit stick.

None of these is expensive. They just need to be decided before the day you need them, not on it.