Fake Invoice SWIFT Payment Diversion — How to Identify & Stay Safe

INDIA — By BharatSecure Threat Intelligence Team · Updated Jul 17, 2026

Severity: Critical | View Full Scam Details

Fake Invoice SWIFT Payment Diversion Scam in India 2026: A Growing Threat to Exporters and SMEs

The Fake Invoice SWIFT Payment Diversion scam is a critical cyber fraud targeting Indian exporters and manufacturers, stealing crores by intercepting legitimate cross-border payments through UPI and phishing on WhatsApp.

What Is the Fake Invoice SWIFT Payment Diversion?

This scam involves fraudsters impersonating trusted suppliers and intercepting payments meant for them via the SWIFT network — the global messaging system banks use to transfer money internationally. In India, this scam mainly targets small and medium enterprises (SMEs) in sectors like textiles, auto components, and chemicals. These businesses frequently receive export payments through SWIFT, making them prime targets.

Scammers find potential victims through public business directories, LinkedIn profiles, and industry forums. They then create fake company websites, official-looking email IDs, and WhatsApp accounts mimicking real suppliers. Using these, they send fake invoices with altered bank details, tricking exporters into sending payments to fraudulent accounts.

This threat is on the rise in India, with several cases reported to cybercrime cells across states. Although RBI and CERT-In have issued broad warnings about payment frauds and phishing, dedicated alerts on SWIFT payment diversion scams have become more frequent given this trend. The Indian Government’s Integrated Cyber Coordination Centre (I4C) continues to monitor such scams under RBI’s auspices.

How This Scam Works — Step by Step

1. Target Identification: Fraudsters list export businesses from trade directories, LinkedIn, or sector-specific forums, focusing on SMEs that transact via SWIFT.

2. Fake Supplier Profiles: Scammers create realistic websites, social media profiles, and email IDs mimicking genuine suppliers’ details.

3. Initial Contact: They connect with exporter employees—often procurement or accounts teams—via WhatsApp or email posing as supplier representatives.

4. Issuing Fake Invoice: After building trust, the fraudsters send a fake invoice demanding payment with SWIFT details that resemble the real supplier’s but lead to fraudulent bank accounts.

5. Urgency and Pressure: They pressure the exporter to initiate the payment quickly, sometimes claiming urgent shipment deadlines or penalties for delayed payments.

6. Payment Diversion: Unaware, the victim’s finance team makes the payment via SWIFT or UPI to the fake account.

7. Money Laundering: Once the money lands in the fake account, it is quickly withdrawn or routed through multiple accounts, making recovery difficult.

8. Delayed Discovery: Only after the genuine supplier complains about non-payment does the victim realize the fraud.

Real Warning Signs to Watch For

• Unexpected changes in supplier bank details, especially IBAN or SWIFT codes, communicated via WhatsApp or email rather than official channels.
• Supplier emails or messages that come from personal or newly created domains instead of verified company domains.
• Invoices with minor spelling errors, formatting differences, or incorrect logos compared to past legitimate documents.
• Pressure tactics urging urgent payment or threatening shipment delays or penalties.
• Requests for payment confirmation through unverified WhatsApp numbers or unfamiliar emails.
• Mismatch between invoice numbers or purchase order details and company records.
• Lack of verification via phone call using known contact numbers before payment.

What Happens to Victims

Victims suffer severe financial losses, often running into lakhs or crores of INR, depending on contract size. Since SWIFT payments are cross-border and pseudonymous, recovering stolen funds is extremely challenging for Indian exporters.

The emotional toll is high — business owners face stress over loss of trust with overseas partners and damage to their company reputation. In some cases, victims also experience harassment over phone and WhatsApp from fraudsters posing as debt collectors.

Additionally, scammers may exploit UPI-linked accounts to drain funds after stealing OTPs via social engineering or SIM swap attacks. The misuse of Aadhaar-linked KYC for bank account opening has been observed in related scams, making this threat increasingly complex.

What RBI and CERT-In Say

The Reserve Bank of India routinely alerts banks and the public about frauds involving payment diversion and urges verification of beneficiary details before transactions. RBI emphasizes not sharing OTPs and using two-factor authentication for UPI and net banking.

CERT-In’s advisories highlight phishing and social engineering attacks on WhatsApp and email as common tools in payment frauds. The 1930 cybercrime helpline operates nationally for victims to report incidents.

The Ministry of Home Affairs, through I4C (Integrated Cyber Crime Coordination Centre), coordinates cybercrime investigations and public awareness campaigns on such evolving scams.

How to Protect Yourself

1. Always verify bank details directly with suppliers using previously known official phone numbers before making payments.
2. Cross-check any changes in invoice details via a separate communication channel, not WhatsApp or email alone.
3. Enable multi-factor authentication (MFA) on banking apps and UPI apps.
4. Do not share OTPs or UPI PINs over calls or messages, even if the caller claims to be from your bank or supplier.
5. Regularly update your WhatsApp privacy settings and be cautious of unknown business profile requests.
6. Confirm any payment instructions or changes in contract terms through your company’s management before proceeding.
7. Use RBI’s recommended secure banking apps and ensure your devices have updated antivirus software.

What to Do If You've Been Targeted

1. Immediately contact your bank’s fraud department and request to block or freeze the suspicious transaction if possible.
2. Report the cyber fraud to the nearest police cybercrime cell or through the national cybercrime portal at cybercrime.gov.in.
3. Call the 1930 cybercrime helpline for advice and assistance on recovery steps.
4. Inform the supplier and confirm correct payment details to avoid duplicate payments.
5. Change all related passwords, UPI PINs, and enable additional security layers on financial accounts.
6. File a formal complaint with RBI’s customer grievance department if the scam involved banking services or UPI transactions.
7. Document all communication and transaction details to assist authorities in investigation.

Frequently Asked Questions

Q: How do scammers get my company’s supplier details?
Fraudsters use publicly available sources like business directories, LinkedIn, and trade forums to gather data on exporters and their suppliers, then create fake profiles resembling the actual suppliers.

Q: Can I recover money lost through a SWIFT payment diversion?
Recovery is difficult as SWIFT payments are irreversible once processed across borders. However, quick reporting to banks and cybercrime authorities may improve chances if action is prompt.

Q: How can I confirm genuine supplier bank details safely?
Always verify changes in bank details by calling previously known, official supplier numbers or visiting their verified websites. Avoid trusting only email or WhatsApp messages for such updates.

If you receive suspicious messages or calls related to payments or invoices, verify them immediately at BharatSecure.app and report fraud to the 1930 cybercrime helpline.

Disclaimer: This article describes a pattern of fraud reported in public sources for public-safety awareness. It is not legal, financial, or medical advice. To request correction or removal of any content, write to hello@bharatsecure.app.