Most small business owners around here picture a scam as a dodgy text or an obvious phishing email full of typos. The one actually emptying Irish company accounts looks far more ordinary. It arrives as a routine note from a supplier you deal with every month, saying they've changed bank. You update the details and pay the next invoice as normal. The money lands in a fraudster's account instead, and by the time the real supplier chases the bill, it's long gone.
The numbers are worse than most people think
According to figures published in March 2026 by FraudSMART, the awareness arm of Banking & Payments Federation Ireland, Irish SMEs lost almost €19 million to email-related scams over two years, with invoice redirection the dominant type. These aren't small stings either. The average loss per incident was over €22,000, and for a micro business that's the sort of hit that puts jobs at risk.
How the invoice trick actually plays out
The whole con hinges on one step looking completely routine, so it helps to walk through it. As reported by RTÉ, most cases start with an email that appears to come from a real supplier. Often it's one whose own mailbox has been hacked, so the address is real.
A trusted-looking email arrives
It appears to be from a supplier you already use. No payment is demanded, just a friendly heads-up that their bank account has changed.
You update the details
Someone in the office swaps the account on file, exactly as they would for any legitimate supplier change. Nothing feels off.
A real invoice turns up
Days or weeks later a perfectly normal-looking invoice lands. It gets paid on time, straight into the account the fraudster now controls.
The real supplier chases you
The actual supplier asks where their money is. Only now does anyone realise, and by then the funds have usually been moved on.
Its nastier cousin: the "urgent" boss email
The same research flags CEO impersonation as the other big one. Here an email pretends to be from the owner or a senior manager, landing on whoever handles payments: "I'm stuck in a meeting, can you sort this transfer today, keep it between us for now." It leans on authority and urgency to push someone past the normal checks. It's less common than invoice redirection but often more convincing, because staff don't like saying no to the boss.
The checks that actually stop it
Prevention is cheap and low-tech. FraudSMART's own advice, plus what I'd tell any client, comes down to a handful of habits:
- Verify every change of bank details by phone, using a number you already hold for that supplier, never the one in the email asking for the change
- Require two people to approve payments over a set amount, so no single person can be tricked into sending money alone
- Treat urgency and secrecy as red flags, especially on emails that seem to come from the boss
- Give staff a two-minute brief on these two scams. Over half of Irish SMEs have no training at all, and that's the gap fraudsters exploit
- Keep computers and phones updated so a hacked mailbox is less likely to be the way in
None of that needs new software or a big budget. It's mostly about building in a pause, so anyone in the business can stop and check a payment without feeling awkward about it.
Where to start this week
Invoice redirection and CEO-impersonation fraud are now the most expensive scams facing Irish small businesses, and it's because they look like ordinary day-to-day admin. Clever technology won't fix that.
A phone call to verify bank changes will. So will a second signature on payments and staff who know the pattern. Get those in place and you've closed the door most of that €19 million walked through.
