Vendor Invoice Fraud & Payment Diversion Investigation
Your accounts payable team received an email from a trusted vendor with new bank details. The invoice was real. The vendor was real. The account was not, and the payment is gone. E3 Legacy Intel traces where the money went, identifies who is behind the diversion, and builds the evidence your bank, your insurer, and your attorneys need for recovery. Licensed investigators, FL A-1400197. Act within the first 72 hours.
The Anatomy of a Diverted Payment
Vendor invoice fraud, also called payment diversion or vendor email compromise, is the version of business email compromise that hits accounts payable. The criminal does not invent a fake invoice. They wait for a real one.
It starts with a compromised mailbox, either yours or your vendor's. The criminal sits inside the email thread for weeks, reading purchase orders and payment schedules, learning who approves payments and how invoices look. Then, at the moment a large legitimate invoice is due, they send a message that matches the thread perfectly: same signature, same tone, same invoice number. Only one thing has changed, the bank account. Sometimes the message comes from the vendor's actual compromised mailbox. Sometimes it comes from a look-alike domain one character off from the real one.
Your team pays the real invoice into the criminal's account. The vendor, unpaid, calls weeks later asking where the money is. By then the funds have moved through one or more mule accounts, and both companies are pointing at each other over who was compromised and who bears the loss. Answering that question with evidence, not opinion, is a large part of what this investigation does.
The First 72 Hours
Call your bank now
Report the payment as fraudulent and demand a recall. For a wire, request that the receiving bank freeze the funds. For an ACH payment, ask about reversal and a hold on the receiving account. Every hour matters.
File at FBI IC3
Report at ic3.gov and flag it for the Recovery Asset Team. A domestic wire over 50,000 dollars reported within 72 hours may qualify for a freeze request before the funds are withdrawn.
Notify the vendor by phone
Call a number you already had on file, never one from the suspect email. The vendor may be compromised and not know it, and other customers may be receiving the same fraudulent bank details right now.
Preserve everything
Save the emails with full headers, the fraudulent invoice, the original invoice, the payment confirmation, and every message in the thread. Do not forward originals around the company; they are evidence.
Call an investigator
Your bank will attempt a recall on the first account. Finding where the money went after that, and proving whose mailbox was compromised, is investigative work no bank performs.
The Question Every Diverted Payment Case Turns On
Whose system was compromised
If the fraudulent email came from the vendor's real mailbox, the loss argument looks one way. If your own mailbox was compromised, or your team missed a look-alike domain, it looks another. We examine the headers, the sending infrastructure, and the available mailbox audit records to establish where the compromise actually happened, and we document it to a standard both sides' attorneys and insurers can rely on.
Where the money actually went
We trace the payment from the receiving account through the mule network, documenting each hop, and identify the accounts that received the funds so recalls, freezes, and legal claims aim at the right targets.
Who is behind it
We work to identify who is behind the fraudulent account, the look-alike domain, and the communications, building the file that supports recovery demands, civil action, and law enforcement referral.
The Forensic Scope
Email and header analysis
We establish whether the diversion email was sent from a genuinely compromised mailbox, a spoofed address, or a look-alike domain, and we preserve the proof.
Tenant review
Where we have access to the compromised environment, Microsoft 365 or Google Workspace, we review sign-in logs, audit records, inbox rules, forwarding, and OAuth grants to find the intrusion, its entry point, and its duration.
Fund tracing
We follow the payment through the receiving account and onward, documenting the path for your bank, your insurer, and counsel.
The Recovery Path
Recovery in a payment diversion case runs on four rails, and the evidence we build feeds all of them. First, bank recall and freeze requests, supported by documentation the banks will act on. Second, the FBI IC3 Recovery Asset Team for qualifying wires. Third, civil routes: demand letters, John Doe actions against unidentified account holders, and garnishment or seizure where funds are located. Fourth, insurance, where the coverage question often turns on exactly the compromise evidence we document. No investigator can promise recovery; what we deliver is the traced path and the identified parties that make recovery possible.
The Liability Question Between You and Your Vendor
When a diverted payment surfaces, the commercial dispute follows immediately: the vendor says you paid the wrong account, you say their email was hacked. Courts deciding these disputes look at whose negligence let the fraud succeed, which is why the compromise determination matters as much as the money trail. Our findings give your counsel the factual record for that fight, whichever side of it you are on.
The File You Walk Away With
Every finding in a payment diversion case ends up in front of a skeptical audience: a bank operations team deciding whether to act on a recall, an insurance adjuster looking for a reason to deny, opposing counsel in the vendor dispute, or a federal agent choosing which file to work. So the deliverable is built for that audience from the first day. Each conclusion is tied to its evidence: the preserved emails and headers, the audit log entries, the traced transactions, and the records behind every identification. The compromise determination states what the evidence shows and what it does not, because an overstated finding collapses exactly when you need it most. You receive the investigative report, the preserved evidence set, and findings your bank, your insurer, your counsel, and law enforcement can each act on without re-doing the work. Licensed. National. Built for court, because that is where a diverted payment case is ultimately decided.
Who We Help
Stay Protected
Vendor bank-change verification
Before your team acts on any new or changed payee bank details, we independently verify the request with the vendor through known-good channels. One verification costs a fraction of one diverted payment.
Post-incident monitoring
For 90 days after remediation we watch for re-compromise attempts, credential reuse, and new look-alike domains registered against you or your vendors.
How These Cases Are Priced
Every engagement is a flat fee, quoted in writing before work begins, so a fraud loss never turns into an open-ended bill. As a framework, insurance claim evaluations start at 5,400 dollars, and full business email compromise investigations, which this is, typically run 12,500 to 25,000 dollars depending on the number of compromised mailboxes, accounts, and jurisdictions. Complex multi-party matters are quoted beyond that range. These figures are frameworks, never final quotes: your quote comes from your facts. Contact us to have your case evaluated and quoted.
Frequently Asked Questions
A vendor emailed new bank details and we paid a fraudulent account. Can we get the money back?
Who is liable when a payment goes to a fraudster, us or the vendor?
How do criminals know exactly when and how to send a fake invoice?
The email came from the vendor's real address. Does that mean the vendor was hacked?
We paid by ACH, not wire. Does that change anything?
How much does a vendor invoice fraud investigation cost?
Two of our wire fraud matters are written up in full: a six figure wire, gone overseas, recovered in weeks, and a $500,000 loss and a partnership worth saving.
Your Examiner
Matt Aubin, CDFE, FBCI
Managing Partner, E3 Legacy Intel · FL Licensed Investigator A-1400197
Every matter on this page is worked under a named, licensed examiner. Matt Aubin brings seventeen years in cybercrime and open source intelligence. He is a Certified Digital Forensics Examiner (CDFE), a Florida Board Certified Investigator (FBCI), and a Certified AI Agent Developer, and he has investigated cases jointly with the FBI, the SEC, the U.S. Secret Service, and the U.S. Marshals.
His work has been featured on ABC News, Spectrum News, and The Daily Beast, and in a television pilot for Netflix and MAC Pictures as a cybercrime expert. He keynotes nationally and serves on the Board of Directors of the Florida Association of Licensed Investigators (FALI). About Matt Aubin
LET’S TALK
Bring us the problem. We will tell you plainly whether investigation can help.
Fill out this form and set up a discovery call with us. From there we will analyze the issues you are having and determine your intelligence needs. Then we will develop a custom, no-obligation quote for our services, delivered in writing before you commit to anything.
Tell us what happened
A licensed examiner reads every inquiry. You get a written, flat fee quote before any work starts. Or call (877) 732-6648.