OVERVIEW OF 2024 ● messages appear more convincing. Second, in today’s fast-paced world, people often multitask and let their guard down. Third, with more individuals shopping online frequently, they are often waiting for deliveries, which increases the likelihood of them mistaking a scammer’s message for a genuine notification about a package. BUSINESSES PLAGUED BY INVOICE FRAUD Invoice fraud has become a relatively common type of scam in which fraudsters send a fake invoice to an organisation under the guise of a legitimate business partner. The phoney invoice usually differs only in the payment account details, making the fraud easy to overlook. The recipient unknowingly transfers money to the fraudsters, while the actual partner continues to wait for payment. This type of fraud can be difficult to detect, as criminals often hijack ongoing correspondence, leading the victim to believe they are still communicating with their business partner. However, changes to account details, which are not a common practice, should serve as a warning sign. In November, we received reports about four cases of invoice fraud with damages totalling nearly €300,000. In one case, an Estonian company transferred over €170,000 to an account controlled by fraudsters. The criminals had compromised the company’s email account and monitored correspondence with a supplier. At the right moment, they sent an invoice in the supplier’s name with altered account details, and the recipient made the payment. In another case, a state-owned company fell victim to fraud when an invoice sent to its general email address appeared legitimate. The amount matched expectations, but the bank account details had been changed. The company transferred nearly €30,000 to the fraudsters, only discovering the fraud when the real business partner, who had not received the payment, asked for a payment confirmation. A third case involved an Estonian company purchasing a new car. Over the course of a month, the company corresponded with a GerCYBER SECURITY IN ESTONIA 2025 How to avoid invoice fraud - Raise awareness about invoice fraud. Everyone in your organisation who approves invoices should understand the nature and signs of such fraud. As a starting point, share the post published on RIA’s blog (ria.ee/blogi/levivad-arvepettused-kontrolli-enne-kui-maksad) and explain the issue to your employees. - Agree on an invoice approval procedure. For example, establish a rule that if invoice details, such as bank account information, have changed, the sender must be contacted through an alternative channel, such as by phone. Be sure to use a known contact number rather than the one listed on the invoice, as fraudsters may replace genuine contact information with their own. - If you or your accountant suspect that a payment has been made to the wrong account, contact your bank immediately. In the age of instant payments, reaction time is limited, but prompt action may allow the bank to reverse the transfer. - If you identify or suspect a fake invoice sent in the name of a business partner, contact the partner immediately. Use a different channel from the one through which the invoice was received. Acting quickly in this way can help uncover the problem before it reaches the next victim. man car dealer, finalised the contract and transferred the payment according to the provided bank details. When it came time to deliver the car, it was revealed that the bank account belonged to fraudsters, and nearly €60,000 had gone to the wrong account. The criminals had hijacked the correspondence and altered the payment details. In another instance, an industrial company fell victim to invoice fraud. The fraudster intercepted correspondence at the right moment and issued a fake invoice. Since the company ➜ 29