I'm a CFO and Almost Fell for This Scam: One Tiny Detail Stopped Him From Sending $10K to a Fraudster

A chief financial officer (CFO) in the United States was about to send $10,000 to what appeared to be a trusted vendor. One doubt stopped him: the deal had been unusually easy to complete. The bank details, order history and email address all looked familiar. The story comes from a Reddit post in r/Scams and could not be independently verified.

How a Fake Vendor Passed Every Check

The company owed the real vendor $25,000, or about £18,700. The payment was on hold while they tried to agree on new terms, but the vendor did not reply. Months later, an email arrived from what appeared to be the same vendor, asking for payment. According to the post, the sender knew the order, account history, and amount owed, and soon agreed to accept $10,000 instead.

The CFO entered the bank details and was about to submit the payment when he thought, 'This was kind of easy.' He called the vendor to verify the request, but there was no answer, and the sender responded by email instead. A closer look at the email address revealed the problem: the domain was almost identical to the real one, except it had an extra 's' at the end. The phone number in the message also had its final two digits transposed.

The executive has a degree in information security and spent five years working as a systems administrator. Even with that background, he nearly sent the money. The warning came from the deal's pace, not an alert mentioned in the post. His experience helped him question the payment before it was too late.

What This Scam Costs in Britain

This type of fraud is commonly known as invoice redirection. In the UK, it falls within the wider category of authorised push payment (APP) fraud, where a victim is tricked into sending money to a fraudster. UK Finance recorded £576.4M in APP losses in 2025, up 19 per cent from the previous year, across 248,070 cases. Overall payment fraud caused £1.28B in losses in 2025.

However, invoice and mandate scams have become less common in Britain. UK Finance says these forms of malicious redirection reached their lowest loss and case totals ever reported in 2025, at £41.3M and 2,305 cases respectively. They now account for just under a quarter of APP losses, compared with more than half in 2020. Ruth Ray, Managing Director of Economic Crime at UK Finance, said fraud operates on an 'industrial scale' and harms people, businesses, and the UK economy.

Jonathan Frost, Global Advisory Director at BioCatch, said: 'Banks are winning the fight against traditional fraud, but criminals have adapted, shifting from hacking systems to manipulating people, and authorised losses are surging as a result.' The post illustrates how that type of social engineering can work. In the reported case, the sender appeared to know details about a genuine business relationship, which made the payment request seem credible. The post does not explain how the sender obtained that information.

Who Gets a Refund, and Who Does Not

Since 7 October 2024, the Payment Systems Regulator's (PSR) mandatory reimbursement rules have generally required in-scope payment service providers to reimburse eligible victims of APP fraud, subject to the rules' conditions, up to a maximum of £85,000 per claim. The rules apply to certain APP payments made through Faster Payments and CHAPS and do not cover all types of transfers. Protection also depends on who made the payment and whether it falls within the scheme.

The rules cover individuals, micro-enterprises, and qualifying charities, including charities with annual income of less than £1M. A micro-enterprise generally means a business with fewer than 10 persons and annual turnover and/or an annual balance-sheet total of no more than €2M. Larger businesses are generally outside the PSR's mandatory reimbursement rules and do not receive the same protection.

The £85,000 reimbursement rules therefore do not apply to every business or every type of bank transfer. UK Finance's APP fraud figures cover a broader range of payments and account types than the PSR's mandatory reimbursement regime. That means the total £576.4M in APP losses should not be read as money that would all qualify for reimbursement.

The Phone Call That Stopped It

Interac, Canada's payments network, advises businesses to confirm unexpected or changed payment instructions directly with the supplier. The company recommends using a trusted phone number or another separate communication channel. A number included in the email should not automatically be treated as trusted. Replying to the same email also does not provide an independent check.

The post does not mention an automated system flagging the payment. Instead, the CFO says he noticed something was wrong before sending the money. His experience shows why direct checks can matter even when an email, invoice and bank details all appear genuine. Calling a trusted number already on file can help stop a payment from reaching the wrong account.