.svg)
.svg)
.svg)
.svg)
.svg)
On 8 October 2026, Abu Dhabi Police warned businesses about fake supplier emails that ask finance teams to change bank details and send payments to new accounts. Police say the fraud is often discovered only after the transfer is complete. This invoice fraud prevention UAE guide is for finance controllers and CISOs, and it covers the controls and staff habits that apply in every sector.
In short: Treat every bank-detail change as unverified until someone calls a number already on file, require a second approver, authenticate your email domain, and rehearse the change request with the people who receive it.
Invoice Fraud Prevention UAE Starts at the Payee
The scam needs no malware. A criminal takes over or imitates a supplier mailbox, reads the thread about an open invoice, and sends a short note saying the bank account has changed. The accounts payable clerk sees a familiar name, a familiar amount and a plausible reason, so the request looks like routine admin.
The scale is visible in US figures. The FBI's Internet Crime Complaint Center recorded 24,768 business email compromise complaints in 2025, with reported losses of about $3.05 billion out of $20.88 billion across all internet crime. That makes this one scam type about 14.6% of everything reported, in the 2025 IC3 annual report.
Abu Dhabi Police describe the same pattern locally, and the warning signs they list are ordinary ones: urgency, a sender domain with a small spelling difference, and an insistence on email over a phone call. Because the signals are ordinary, prevention has to sit in the payment process and in habits staff have practiced, not in instinct alone.
A Bank-Detail Change Procedure, Step by Step
Abu Dhabi Police's guidance, also reported by Emirates 24|7, tells finance teams to verify bank-detail requests through official channels. What decides whether that works is where the phone number comes from, so write the procedure for the vendor master change itself:
- Log the request on receipt: who received it, when, by which channel and which account details it asks for. Change nothing yet.
- Take the verification number from the vendor master, created at onboarding or from the signed contract, never from the email, its signature or an attached letter.
- Call and ask the contact to read back the new account name and number. Record who called, which number, when and who answered.
- If the known contact cannot be reached, try a second contact on the contract or the supplier's account manager. Leave the existing details in place until someone answers.
- Have a second authorized employee, who did not take the call, review the log and approve.
- Hold the first payment to the changed account until the approver has checked that the account holder name matches the supplier's legal name on the contract.
A change request is also a signal. Abu Dhabi Police list urgency, a sender domain with a small spelling difference, an insistence on email over a phone call, and a payment account in a different country from the supplier's usual location as warning signs. Treat each one as a reason to hold the request until a second approver has seen it.
The log is what makes the procedure auditable. Months later, a controller can pull any changed account and see the call, the number and both approvers, which tells you far more than a policy that says verification happened.
Prevention Points by Sector
Bank details change fraud works anywhere suppliers are paid by transfer. Construction invoice fraud UAE cases get the attention, and we cover that chain of developers, contractors and subcontractors in Invoice Fraud in UAE Construction. What differs is who holds the supplier relationship, who can ask for a change and where requests arrive, so adjust these typical set-ups to yours.
Healthcare. In a typical hospital group, procurement owns the supplier relationship and finance runs the payment. Make procurement place the call-back, because it holds the contacts, and keep approval with finance so two functions see every change.
Retail and e-commerce. A payables desk with many logistics and service suppliers sees a steady flow of invoices, so a change request can look like part of the flow. Accept account changes only through one form or ticket, never inside an invoice email, which gives clerks a clear reason to refuse an emailed request.
Higher education. Departments often deal directly with contractors and may forward requests to central payables. Make the central team the only intake point for payee changes, and tell departments that a request passed along by email is not a verified change.
Groups with shared finance teams. One team often pays several entities. Verify and log each change per entity, so a call made for one company is never reused as proof for another.
Who Owns What: Finance and Security
A procedure without owners gets skipped. The controller owns the steps above: who may edit the vendor master, the approval limits, the call log and the hold on first payments. The CISO owns the mailbox side: email authentication with DMARC, DKIM and SPF, and a route for staff to report lookalike domains and odd requests.
Give the two roles a standing exchange. Security sends finance the supplier-related reports it receives, finance sends security the list of bank-detail changes made, and once a quarter both sample changed accounts to confirm each has a call record and a second approver.
The approval step can be automated without removing the person. In Agentic Automation Rules, higher-stakes actions such as a finance approval hold always wait for analyst approval, so the hold is never applied without a person's decision.
Rehearse the Request Before It Arrives
Controls fail at the moment of pressure. The day before a payment run, a supplier writes that the account has changed and the money is due today. A clerk with a written rule, who knows that calling back is expected and not rude, makes the call. A clerk who was only told to be careful often pays.
Make the call-back normal. Say in training and in the procedure that verification is part of the job and that no supplier will be offended by it.
Report what looks odd. A lookalike domain or an unusual urgency is worth a message to the security team, even when the clerk did not act on it. Our guide to business email compromise training for finance teams covers what to teach.
Then test the procedure with the people who run it. Whitebait runs phishing simulation for UAE and GCC organizations, with Arabic and English templates, and tracks reporting rate next to click rate. Send a supplier bank-detail change scenario first to the staff who can edit the vendor master. A reporting rate that rises while the click rate falls tells you the habit is forming.
When someone does act on a doubtful request, the lesson lands best straight away. Zero-Touch Training responds when a person shows a security risk, with training matched to the behavior, delivered inside Microsoft Teams in the flow of work.
Start With One Page
Return to the clerk holding a new account number the day before the payment run. With a log, a verified number and a second approver in place, the request costs a few minutes and the real supplier gets paid. Without them, the transfer can leave before anyone doubts it.
This week, write the six steps on one page, name who places the call in each team, and share it with everyone who can edit a supplier record.
Frequently Asked Questions
What is bank details change fraud?
A criminal impersonates a supplier, or uses a compromised supplier mailbox, and emails a request to pay future invoices into a new account. Abu Dhabi Police warn that it is often discovered only after the transfer is complete, so the check has to happen before the payment leaves.
What if we cannot reach the supplier's known contact?
Leave the existing bank details in place and try a second contact on the contract or the supplier's account manager. Never use a number from the request itself. If the payment is due, tell the approver and record the delay, because a late payment can be explained to a supplier and a payment to the wrong account may not be recoverable.
Who owns invoice fraud prevention, finance or security?
Both. The controller owns the procedure, the approval limits and the call log. The CISO owns mailbox security and the route for staff to report suspicious requests. Reviewing a sample of changed accounts together each quarter keeps either side from assuming the other has checked.
Does the same procedure fit every sector?
The steps stay the same. What changes is who places the call and where requests enter: procurement in a hospital group, one form or ticket in retail, central payables in a university. Decide those two points for your own organization, then apply the six steps without exceptions.
.png)
