The Invoice Was Real. The Bank Details Were Not.

How a familiar supplier email becomes a five-figure business risk — and the simple checks Irish SMEs can put in place today.

Written by Safegram Editorial Team

20 October 2026 • Dublin, Ireland

A routine finance conversation can be the last chance to question a changed payment instruction. AI-generated editorial illustration, not a photograph of a reported incident.

Ireland’s small businesses lost €18.9 million to email-related scams over a two-year period, according to figures published by Banking & Payments Federation Ireland in March 2026. This October, as Europe focuses on cybersecurity at work, the most useful response may not be another complicated tool. It may be a rule: never change a supplier’s bank details without independent confirmation.

Key takeaways

• FraudSMART/BPFI reported €18.9 million in SME losses from email-related scams over the preceding two years; average losses seen by participating institutions exceeded €22,000 per incident.
• Invoice-redirection fraud can begin with an ordinary request to update a supplier’s IBAN. The next genuine invoice may then be paid to the wrong account.
• A small February–March 2026 ISME-member survey found 53% of respondents had no dedicated employee fraud-awareness guidelines or training; its sample was 65 businesses, not a national census.
• Independent supplier call-backs, dual payment approval, multifactor authentication and a written payee-change process are practical defences.
• Verified online profiles can improve identity signals at discovery, but no badge replaces checking a payment destination.

A legitimate invoice can carry a false destination

Consider a hypothetical Dublin café that orders fresh produce from the same wholesaler every week. The relationship is established, the purchase order is expected and the invoice amount is normal. But before the invoice arrives, someone apparently representing the wholesaler asks the café to update the bank account used for future payments.

Nothing else in the business relationship needs to change. The delivery still arrives. The invoice is genuine. The money is simply routed to an account that does not belong to the supplier.

That is invoice-redirection fraud: a scam in which a business is tricked into changing the account to which it pays a real or supposed supplier. It is a common form of business email compromise (BEC), a wider category of attacks involving impersonation of trusted contacts. A criminal might impersonate an address or exploit an already compromised account. The danger is not always a glaringly fake invoice; it is the misplaced confidence created by an existing working relationship.

Ireland’s National Cyber Security Centre (NCSC) describes BEC as impersonation of an executive, supplier or employee to obtain money or sensitive information. FraudSMART advises businesses to verify proposed bank-detail changes using a contact they already know — not the phone number supplied in the change request. [2, 3]

The Irish numbers are too large for this to be an IT-only issue

On 27 March 2026, FraudSMART, the initiative led by Banking & Payments Federation Ireland (BPFI), reported that Irish SMEs had lost €18.9 million to email-related fraud over the preceding two years. Its member institutions were seeing average losses above €22,000 per incident. Invoice redirection and CEO impersonation were identified as prominent risks. [1]

A separate survey conducted with ISME members in February and March 2026 found that 67% of the 65 respondents said their business had been targeted by a financial scam during the previous 12 months. Among respondents, 53% reported having no specific employee fraud-awareness guidelines or training. The sample is small and should not be treated as a representative estimate for every Irish SME; it nevertheless gives owners a gap they can test in their own workplace. [1]

The timing is relevant. European Cybersecurity Month runs throughout October 2026, with this year’s emphasis on workplace skills and preparedness. The message matters especially for independent retailers, trades, hospitality businesses, creative agencies and solo entrepreneurs who handle commercial messages through email, messaging apps and social media without a dedicated finance department. [4]

Why the safest response is sometimes to break the conversation

A suspicious payment instruction can arrive inside an otherwise normal conversation. That is precisely why replying to the same email or calling the number in its signature may not establish anything. If the sender’s account is compromised, the attacker may see or influence the reply. If a message has been impersonated, the contact details may lead back to the fraudster.

Independent verification means starting a fresh conversation using a number or contact method the business had recorded before the request. Reach a known person at the supplier, confirm the change, record the outcome and do not release payment until the check is complete. Apply the same rule when a request appears to come from the owner, accountant or most senior person in the company. [2, 3]

A Dublin construction team checks the supplier directly before amending payment details. AI-generated editorial illustration.

A seven-minute payment-security drill

A small organisation does not need a complex cybersecurity department to practise its first defence. It needs a repeatable process that survives a busy Friday afternoon, a staff absence or an urgent message from a familiar customer.

Minute 1: decide who can edit supplier details

Give one accountable employee responsibility for the supplier register. Record how new payees are approved, who may change an IBAN and where independently verified contact details are held. Shared spreadsheets without appropriate permissions or change history create unnecessary uncertainty.

Minutes 2–3: establish the independent call-back

Require a phone call to a previously recorded supplier number for every bank-detail change, including requests from familiar employees or long-standing vendors. Never rely solely on a number shown in the new email, chat message or invoice. Record the date, person reached and confirmation outcome.

Minute 4: add a second pair of eyes

Use dual approval for significant transfers and first payments to a recently changed account. The second approver should examine the payee independently, not simply press “approve”. FraudSMART specifically recommends dual electronic authorisation for third-party payments. [1]

Minute 5: secure the channels people use

Enable multifactor authentication on company email and finance accounts; use strong unique passwords, keep devices updated and limit access to payment systems. Encryption and identity verification can address some risks but cannot establish that every payment instruction is correct.

Minutes 6–7: rehearse the scenario

Ask one colleague to play the supplier and another to respond to a fictional account-change request. Can the recipient find the independently stored number? Does the request stay on hold until confirmation? Does a second approver know what to check? If not, improve the procedure and test it again. This is training with a practical outcome, not a forgotten slide deck.

When a local booking turns into a payment risk

The same challenge appears in the creator economy and local commerce. A video maker receives an enquiry from a restaurant; a photographer quotes a wedding venue; a contractor negotiates a renovation deposit. The first interaction might begin on a social platform, move to direct messages and finish with a transfer. Each hand-off leaves room for confusion.

A false account may imitate a familiar creator; an authentic customer may receive a forged payment change; an agency may treat an IBAN on a screenshot as current. Digital trust therefore cannot end at discovery. It must be maintained when the transaction actually happens.

Safegram is pursuing a model that joins verified profiles, local discovery and creator or business service listings inside Safegram Exchange. That can help a prospective customer see who is offering a service. Its longer-term ambition is to connect more of the enquiry, booking and payment journey around a persistent trust layer, rather than scattering the relationship across unrelated tools. But a verified profile is not a guarantee against compromised accounts, fraudulent payment instructions or mistaken transfers.

The distinction matters to young platforms and established marketplaces alike. Verification can help establish who opened an account; payment security needs appropriate checks at the moment money moves, clear dispute processes and transparent explanations of what is — and is not — protected.

Trust is built in the workflow, not just the profile

Established services have genuine strengths: banks offer fraud teams and transaction controls; specialist marketplaces can provide structured merchant onboarding; social networks bring extensive discovery; dedicated booking software solves sector-specific problems. These advantages deserve acknowledgement.

Yet the journey between social discovery, messaging, invoicing, payment and after-sales support remains fragmented for many small teams. Safegram intends over time to reduce that fragmentation across trusted identity, community, products, services and bookings. Whether a unified experience is demonstrably safer will depend on accountable operations and measurable controls — not a marketing promise.

An independent retailer reviews a request before it enters the payment process. AI-generated editorial illustration.

What to do if you have already paid the wrong account

Act quickly. Contact the bank or payment provider immediately, explain that the transfer may be fraudulent and ask whether it can be recalled or stopped. Recovery is not guaranteed, particularly for an authorised bank transfer. Preserve the original messages, full email headers, invoices, account details and transaction references. Report suspected criminal fraud to An Garda Síochána and consult NCSC incident-reporting guidance if a cyber compromise is involved. [3, 5]

Secure affected accounts, review recent logins and warn legitimate suppliers or customers if communications may have been impersonated. Do not investigate solely through a mailbox you suspect is compromised. If personal data has been exposed, separately consider the organisation’s data-protection notification duties.

Prevention should not be reduced to telling employees to be “more careful”. A rushed employee should be able to rely on a rule that prevents a questionable payment until somebody checks it. Well-designed procedures protect people precisely when they are busy.

The question every owner should ask this morning

Ask whoever handles payments: what happens if our largest supplier emails today to change its IBAN? If the answer is “we update the spreadsheet”, the business has found an urgent improvement. If the answer is “we call the independently verified number, document the approval and require a second sign-off”, the team has a defence worth practising.

European Cybersecurity Month ends on 31 October. A sensible payment process should last much longer.

Frequently asked questions

What is invoice-redirection fraud?

It is a scam in which someone impersonates a supplier or other trusted party and persuades a business to pay into a fraudulent bank account, often by requesting a change to stored IBAN details.

How is invoice redirection different from phishing?

Phishing seeks to trick recipients into revealing information, clicking a harmful link or taking another unsafe action. Invoice redirection is a specific payment-diversion tactic and may involve phishing or compromised business email.

How much have Irish SMEs lost to email scams?

FraudSMART/BPFI reported €18.9 million in losses over the two years preceding its 27 March 2026 publication. The figure covers email-related scams, not invoice-redirection fraud alone.

Is replying to a supplier email enough to verify new bank details?

No. A reply may reach someone controlling a compromised mailbox. Independently contact the company using a previously verified phone number and document the response.

What is the simplest protection for a small business?

Require an independent call-back before changing supplier bank details, a second approval for significant payments and multifactor authentication on business email.

Does a verified business badge mean a payment is safe?

No. Verification can provide evidence about identity but does not validate every bank account, instruction or later transaction.

Where should an Irish company report a fraudulent payment?

Contact its bank immediately and report suspected criminal fraud to An Garda Síochána. Use National Cyber Security Centre resources where an email or network compromise is involved.

Take action

Start with one improvement today: write down the rule for changing supplier bank details, give a colleague responsibility for enforcing it and test it with a realistic scenario. Local businesses and creators developing a verified professional presence can explore Safegram Exchange at https://safegram.com — while maintaining independent payment checks wherever a transaction happens.

Sources and references

1. Banking & Payments Federation Ireland / FraudSMART, “Almost €19 million lost by SMEs to email-related scams over the past two years”, 27 March 2026. https://bpfi.ie/almost-e19-million-lost-by-smes-to-email-related-scams-over-the-past-two-years-fraudsmart/

2. FraudSMART, “Invoice Re-Direction Fraud”, business guidance, accessed 20 October 2026. https://www.fraudsmart.ie/business/fraud-scams/email-fraud/invoice-re-direction-fraud/

3. National Cyber Security Centre, “Protecting Against Business Email Compromise and Payment Fraud Guidance”, accessed 20 October 2026. https://www.ncsc.gov.ie/guidance/

4. European Commission / European Digital Skills and Jobs Platform, “European Cybersecurity Month 2026”, October 2026. https://digital-skills-jobs.europa.eu/en/latest/news/european-cybersecurity-month-2026

5. National Cyber Security Centre, incident reporting and cyber-security guidance, accessed 20 October 2026. https://www.ncsc.gov.ie/npc24/