The email looks ordinary. Same supplier logo, same project nickname, same slightly rushed tone. Only the account number is wrong — and by the time finance calls to ask why payment hasn’t arrived, the money has hopped through accounts that won’t answer the phone.
New Zealand SMEs are reporting a spike in invoice-redirect fraud. The scams succeed because they piggyback on real threads: a delayed shipment, a shared Dropbox link, a weekend urgency that feels familiar.
Defences aren’t exotic. Out-of-band verification for bank detail changes, dual approval on large payments, and staff drills that treat “just this once” as a red flag. Companies that practice those habits lose less; those that don’t learn expensively.
Banks can reverse some transfers. Many they can’t. The uncomfortable lesson is cultural as much as technical: trust, but call back on a number you already know.
Invoice-redirect crews succeed because they weaponise familiarity. The defence is ritual, not cleverness.
- Verify bank-detail changes on a known phone number.
- Require dual approval above a clear dollar threshold.
- Train staff on weekend-urgency language patterns.
- Keep a written “pause” policy that leadership will back.
Companies that rehearse those steps lose less — and sleep better after a close call.
None of this arrives as a clean discontinuity. It shows up as slightly different meetings, slightly different checklists, and a few people who quietly stop doing the old workaround because the new path finally hurts less.
Seen up close, the pattern is less about breakthrough theatre and more about quieter competence: fewer surprises, clearer owners, and tools that survive contact with Tuesday afternoon.
Seen up close, the pattern is less about breakthrough theatre and more about quieter competence: fewer surprises, clearer owners, and tools that survive contact with Tuesday afternoon.