5 Checks Before Paying a Year-End Invoice or Bank-Detail Change
Fake invoices and vendor bank-detail change emails peak at year-end. Five checks catch them before money leaves your account.
The last weeks of the year are heavy with payments: final vendor bills, bonus runs, and the first W-2 requests. Fraudsters build their calendars around yours. Fake invoices and bogus bank-detail changes rise right alongside the legitimate traffic.
The IRS repeats warnings about fake invoices and W-2 phishing every filing season, and the pattern is unchanged. An email arrives that looks like a routine vendor note. It asks for one small thing: pay this invoice, or update the remit-to account. Everything else can be real, because attackers often start inside a compromised mailbox.
AI has removed the old giveaways. The grammar is clean and the layout matches the vendor’s real bills. The control that still works is the callback, and here is the short list we would put in place now.
Five checks before you release a payment
- Call back on any bank-detail change, using a number you already hold. Never use a phone number printed in the email itself.
- Require a second approval, or a callback, before any direct deposit change goes live. This applies to employees as well as vendors.
- Pull the vendor’s payment history before paying anything that looks new. A new remit-to account, a new email domain, or an odd amount means stop and verify.
- Turn on multi-factor authentication for QuickBooks, payroll, your bank, and your email. Then remove user accounts belonging to people who have left.
- Treat any January request for emailed W-2 copies as a scam until it is verified by callback. No legitimate process needs the whole file sent by email.
Lookalike domains are the strongest tell
Attackers register domains one character away from the real one, or insert a word such as “payments” into it. On a phone screen the difference vanishes. Expand the sender’s address to the full domain before trusting a payment request, and compare it against older mail from the same vendor.
Check the reply-to field as well. The visible sender and the actual reply address can differ, which is often the only visible sign of a redirected thread.
Lock down the accounts that move money
Your accounting system is the last line of defense. Limit who can edit vendor payment details or employee direct deposit records in QuickBooks. Review the user list and remove anyone who no longer needs access.
Multi-factor authentication on the Intuit account keeps an attacker out even when a password leaks. The same applies to the bank portal and the email provider, since a mailbox is usually the way in.
If a payment has already gone out
Contact your bank immediately and ask about a recall. Then call the real vendor on the number you already hold, change passwords tied to the compromised mailbox, and review recent bills for changes you did not authorize. Speed matters more than embarrassment here.
Start before the rush does
Pick your ten highest-payment vendors and confirm each callback number this week. Write the callback rule where whoever approves payments will see it, and agree on a two-person rule for direct deposit changes. The setup costs an afternoon. A single fraudulent wire costs far more.