Vendor Invoice Fraud via SWIFT Details Change

INDIA — By BharatSecure Threat Intelligence Team ·

Verdict: Suspicious | Risk Score: 8/10 | Severity: high

Category: UPI, WhatsApp, Government Impersonation

How Vendor Invoice Fraud via SWIFT Details Change Works

Overview: Vendor Invoice Fraud is a cunning scam where criminals pose as genuine suppliers and trick Indian companies into paying invoices to attacker-controlled bank accounts—often altering SWIFT instructions right before payment. This attack can hit any business that handles third-party payments or vendor settlements, leading to direct financial losses, broken business relationships, and operational paralysis. How It Works: 1. Scammers monitor or infiltrate email exchanges between a company and its vendors. 2. Before a large invoice is settled, the fraudster sends an email (or WhatsApp message) mimicking the genuine supplier, claiming a bank account change "due to audit" or "account maintenance". 3. The new details feature a different SWIFT code or international account, often in a hard-to-recover jurisdiction. 4. The accounts team, trusting the sender (whose address [ADDRESS_REDACTED]s. 5. The real vendor never receives payment; company funds are irretrievably lost. India Angle: Particularly impactful among exporters, importers, and manufacturing SMEs, this scam exploits the vast vendor bases in Indian business. Common in trade hubs like Delhi, Mumbai, and Surat. UPI is rarely used; focus is on SWIFT, NEFT, IMPS or direct wire transfer platforms. Communication is mostly in English, but major Indian language variants are emerging. Real Examples: - A Surat diamond exporter lost Rs 38 lakh when an email, appearing to be from their Belgium supplier, requested an urgent SWIFT code update citing a 'bank audit'. - A Delhi auto parts firm was duped on WhatsApp into sending a quarterly payment to a scammer’s overseas account after receiving a supposed bank update letter with forged letterhead. Red Flags: 1. Last-minute email or message announcing change in vendor bank details. 2. New SWIFT code or account details for regular supplier, with no prior warning. 3. Pressure for urgent payment due to ‘shipping deadlines’, ‘bank issues’ or ‘audit’. 4. Typo, extra characters, or minor domain changes in sender’s address. Protective Measures: - Always call the vendor on a trusted number to validate any bank account or SWIFT code update. - Flag all requests to change payment details, especially from new or unfamiliar contacts. - Require management sign-off and secondary verification for all large or overseas payments. - Record and review all vendor master data change logs in your ERP. If Victimised: - Contact your bank, provide transaction details, and attempt to block the fund. - Make an immediate complaint at cybercrime.gov.in and call 1930. - Report the incident to the relevant police and company’s legal/vigilance team. Related Scams: - Executive Email Compromise: CEO/CFO impersonation for payment instructions. - Supplier Impersonation on WhatsApp: Last-minute payment changes via chat.

How This Scam Works — Detailed Explanation

In India, Vendor Invoice Fraud via SWIFT Details Change has become a prevalent threat targeting businesses of all sizes. Scammers often begin by monitoring or infiltrating email exchanges between a company and its suppliers. They may exploit weaknesses in the communication chain, either by malicious hacking or social engineering techniques to gather sensitive information. Many criminals leverage platforms like WhatsApp to rapidly create a façade of authenticity. This includes using phone numbers that are nearly identical to a legitimate vendor's, making it harder for a busy accountant or manager to notice the fraud. Scarier still, some attackers manage to impersonate senior management, sending emails that appear credible to induce panic or urgency in their targets, thereby increasing the likelihood of compliance.

Once scammers have access to these conversations, they employ psychological tactics to manipulate their victims. They often send emails that use a sense of urgency, claiming that an immediate payment is necessary due to shipping issues, pending audits, or tax deadlines. For example, a company may receive a message alleging that their regular vendor has updated their bank account details and requires immediate processing of payments to avoid service interruptions. These messages may appear to originate from a known Gmail or corporate domain, making them more convincing. Scammers also often use slightly modified spellings (e.g., "vender" or "bank-of-india.net" instead of the official “bankofindia.in”) to sow further confusion and doubt in the minds of unsuspecting employees.

Victims of this scam typically encounter a series of harrowing events—starting with the immediate financial loss after processing the fraudulent invoice. For instance, consider a medium-sized manufacturing company that unknowingly wired ₹30 lakh (3 million) to an attacker’s account rather than to the intended supplier. Following the payment, victims often receive threats or demands for more money under the guise of additional fees, hoping to exploit their trust and urgency to further their own interests. The fallout from such scams can extend beyond financial losses; they can lead to significant disruption in operations, lost contracts, and damage to vendor relationships that take years to rebuild.

India has seen a dramatic increase in incidents of Vendor Invoice Fraud via SWIFT details changes, with reports indicating that over ₹1,200 crore were lost to various types of corporate fraud in the last year alone. According to the Ministry of Home Affairs, most of these scams utilize sophisticated techniques that defy traditional detection methods. CERT-In regularly issues advisories alerting businesses to the vulnerabilities associated with financial transactions and has urged companies to implement stronger verification measures. With the Reserve Bank of India's increasing focus on digital banking security, firms must remain vigilant against these scams, as they can also attract regulatory scrutiny for failing to protect against such breaches.

To differentiate a legitimate communication from a scam, companies should establish clear internal protocols for verifying invoice changes. Red flags include sudden changes in a vendor's SWIFT or bank details, insistence on immediate action, and messages that contain small spelling errors. Additionally, employees should be trained to recognize the signs of urgency that often accompany these fraudulent requests, advising them always to double-check account details through a separate communication channel, such as a phone call to the supplier, before processing any payments.

Visual Intelligence:

BharatSecure's AI has identified this as a used in scams targeting Indian users.

Who Does Vendor Invoice Fraud via SWIFT Details Change Target?

General public across India

Red Flags — How to Identify Vendor Invoice Fraud via SWIFT Details Change

  • Sudden change in regular vendor’s SWIFT or bank details
  • Request tied to urgency (audit, shipment, tax reasons)
  • Sender’s email or WhatsApp has tiny spelling/domain differences
  • Insistence on immediate processing without usual checks

What To Do If You Encounter Vendor Invoice Fraud via SWIFT Details Change

  1. Report the incident immediately to your bank using their helpline, such as SBI 1800-11-1109 or HDFC 1800-202-6161.
  2. Contact the cybercrime helpline at 1930 to report the scam and seek guidance on next steps.
  3. Notify your company’s compliance department and finance team about the potential fraud to prevent further payments.
  4. Gather all relevant evidence, such as emails and transaction records, for investigation purposes.
  5. Review and update internal protocols for vendor communications and payments to tighten security.
  6. Educate staff about Vendor Invoice Fraud and provide training on recognizing scam indicators.

How to Report Vendor Invoice Fraud via SWIFT Details Change in India

  • Call 1930 — National Cyber Crime Helpline (24x7)
  • File a complaint at cybercrime.gov.in
  • Contact your bank immediately if money was lost
  • Call RBI helpline: 14440 for banking fraud

Frequently Asked Questions

What to do if I shared my bank details in a fraudulent invoice payment?
Contact your bank immediately to report the incident at SBI 1800-11-1109 or HDFC 1800-202-6161, and also contact the cybercrime helpline at 1930.
How do I identify a vendor invoice fraud attempt?
Look for sudden changes in vendor payment details, urgency in the request, and any discrepancies in email address spellings or formats.
How do I report a vendor invoice fraud in India?
You can report this scam by contacting the cybercrime helpline at 1930, or visiting cybercrime.gov.in for further guidance and to file a report.
How can I recover my money after falling victim to this scam?
Unfortunately, recovery is often challenging; however, contact your bank immediately and file a report with the cybercrime helpline at 1930 for guidance on further actions.

Related Scams in India

Verify Any Suspicious Message

Check any suspicious message, link, or call for free at bharatsecure.app. BharatSecure uses AI to detect scams in real-time and protect Indian users.