Business Email Compromise and Invoice Fraud: How the Scam Works in South Africa

Business email compromise (BEC) is a scam where criminals take over or imitate a business email account to trick someone into paying money into the wrong bank account. In South Africa it most often looks like a genuine supplier invoice with "updated banking details". You can stop it with multi-factor authentication, DMARC on your domain, and one simple rule: every change to bank details is confirmed by phone.

BEC is widely described as the most financially damaging type of cybercrime in South Africa. INTERPOL's 2026 Africa cyberthreat report attributed about 70% of the continent's BEC detections to South Africa, and identified local BEC networks that have operated since 2017.

How does a business email compromise attack work?

1. Access: the criminal steals a password, often with a fake Microsoft 365 login page, or registers a lookalike domain (for example cyber-guards.co.za instead of cyber-guard.co.za).
2. Watch: they read the mailbox quietly, sometimes for weeks, learning your suppliers, amounts, payment dates and writing style.
3. Hide: they set up inbox rules that move replies to a hidden folder, so the real owner never sees them.
4. Strike: at the right moment, they send a real-looking invoice or a "please note our banking details have changed" letter.
5. Cash out: the money lands in a mule account and is moved on within hours.

Who gets targeted?

Any business that pays or receives invoices. In South Africa, these sectors are hit regularly:

• Property and conveyancing: deposits and transfer payments
• Medical practices: supplier payments and medical aid correspondence
• Accountants and bookkeepers: client payments and tax-related emails
• Logistics, construction and wholesale: large, regular supplier invoices
• Schools: fee payments and supplier contracts

6 warning signs an invoice email is fake

1. The banking details have changed, especially to a different bank or an account in a personal name.
2. There's pressure to pay fast: "pay today to avoid suspension" or "the MD needs this before 3pm".
3. The sender address is almost right: an extra letter, .com instead of .co.za, or a free Gmail address.
4. The "bank change letter" is a PDF with a logo but no phone number you can check independently.
5. The reply-to address is different from the sender address.
6. You're asked to keep it confidential or to skip the normal approval process.

What should I do if I've paid a fake invoice?

1. Call your bank's fraud line immediately. Speed matters. Funds can sometimes be stopped if the bank is told within hours.
2. Open a case with SAPS and keep the case number.
3. Call your cyber cover provider. If you're a Cyber Guard client, call us on +27 68 918 3511 to start a warranty claim.
4. Secure the mailbox: reset the password, sign out all sessions, turn on MFA and delete any suspicious inbox or forwarding rules.
5. Find out whose mailbox was compromised: yours or your supplier's. This affects who carries the loss and what happens next.
6. Check your POPIA duties: if personal information was accessed, you must notify the Information Regulator and the people affected.

How do I prevent business email compromise?

• Phone verification rule: every new or changed bank account is confirmed by phone on a number you already have. This alone defeats most BEC attempts.
• Two people approve payments above a set amount.
• MFA on every mailbox, so a stolen password isn't enough to get in.
• SPF, DKIM and DMARC on your domain, so criminals can't send email as your exact address. Check yours free.
• Advanced email filtering that catches lookalike domains and fake login links.
• Monitoring for suspicious logins and new forwarding rules.
• Tell your clients on every invoice: "We will never change our banking details by email."

For the full set of email security steps, read our practical guide to business email security in South Africa.

Will insurance or a warranty cover money lost to invoice fraud?

Your bank usually won't: it generally treats a payment you authorised as your instruction. Good cyber cover can, with one important condition.

The Cyber Guard cyber warranty covers theft of funds, including money transferred after a fraudulent payment instruction, as long as your proper verification process was followed. In practice, that means you confirmed the new banking details by phone on a number you already had before paying. Skip that check, and the loss may not be covered.

So the phone verification rule protects you twice: it stops most scams, and it keeps your cover valid if one still gets through. See what the warranty covers.

How Cyber Guard helps stop invoice fraud

Cyber Guard is a Johannesburg-based managed security provider powered by Trend Micro. We stop fake invoice emails before your team ever sees them, and back you financially if one gets through:

• Email security that blocks phishing, lookalike domains and business email compromise
• Microsoft 365 and Google Workspace protection that spots account takeover and suspicious inbox rules
• Endpoint and mobile protection on every laptop, desktop and phone
• 24/7 detection and response by Trend Micro AI and the Cyber Guard team
• A one-page payment verification policy for your team
• A cyber warranty of up to R1,000,000, underwritten by Hollard, that covers theft of funds, claims against you and recovery costs
• Plans from R69 per user per month, month-to-month, usually protected within 48 hours. See pricing.

Frequently asked questions

Is business email compromise the same as phishing?

No. Phishing is a tactic, usually used to steal passwords. Business email compromise is the fraud that follows: using a hacked or fake mailbox to redirect payments.

Will my bank refund me if I paid a fake invoice?

Not automatically. If you authorised the payment, banks usually treat it as your instruction. Report it immediately anyway, because acting quickly improves the chance of recovering funds.

Who is liable if my supplier's email was hacked?

It depends on the facts and your contracts, and South African courts have considered this question in recent cases. Get legal advice. Preventing the fraud is far cheaper than arguing about it afterwards.

Can antivirus stop business email compromise?

Not on its own. Many BEC emails contain no malware at all, just a convincing request. You need email authentication, MFA, advanced filtering and a payment verification process.

Does the Cyber Guard warranty cover a fraudulent payment?

Yes. Theft of funds is covered, including money transferred after a fraudulent payment instruction, provided your proper verification process was followed, such as confirming the new banking details by phone on a known number. Limits, deductibles and conditions apply.

Sources: INTERPOL African Cyberthreat Assessment 2026 (via IOL); The ever-evolving threat of cybercrime in South Africa (Zawya); Cyber Guard warranty terms.