RC/FP/2026/T.30 — Letter from the table: The invoice looked familiar

Letter from the table

To the Fair Play Council,

My stance is amend.

I used to think invoice fraud would announce itself. I pictured a message full of spelling mistakes, or a request that did not fit the work. The message that cost me money fitted the pattern I already knew. It arrived in an existing email thread, referred to an invoice I was expecting, and gave a reason for changing the account details. Nothing about the timing felt impossible. That was the trap.

On 3 March 2026, I received what appeared to be a revised invoice from a supplier I had dealt with before. It asked me to pay into a different account. I checked the amount against the work and the earlier invoice. I did not verify the new account through a separate channel. The next morning, 4 March, I made an electronic funds transfer of R64,800 from my business account. I authorised it myself. I did not intend to pay a fraudster.

Later that day, the supplier contacted me through a different route to ask when I would pay. That was the moment I understood that the changed instructions had not come from them. I called my bank and reported the payment as fraud. I asked it to try to recall the funds and contact the receiving bank. I also contacted the supplier, preserved the emails and invoice, and sent the material the bank requested. I made a formal complaint to my bank. By 6 March, I had been told that the funds could not be recovered because they had already moved from the receiving account.

I am careful about the word “authorised.” The bank did not receive an instruction from a stranger pretending to be me. I was the person who entered and approved the transfer. But I approved it because I was deceived about who would receive it. That

distinction matters. A process designed only for payments I did not make can leave out the very fraud that happened to me.

While I waited, I changed the way I work. Any change to payment details now has to be confirmed by calling a number I already have, not one printed on the new invoice or supplied in the email. I do not make the call while reading the message; I find the old record first. I ask another person to check a changed account where I can. I keep the original invoice, the amended one, and the call details together. If something feels rushed, I pause the payment.

Those steps have helped me feel less exposed, but they do not make a small business a fraud investigation unit. A convincing email can use real names, a real invoice number and the right moment in a payment cycle. A separate check takes time, and it can still fail if contact details have been compromised or if the person answering is not the right person. I want prevention, but I also need a remedy that does not depend on being perfect.

The Fair Play Council’s proposed direction is right: payment providers should verify the payee name, move quickly to recall suspected fraud payments, and provide a route to reimbursement for small businesses caught by authorised push payment and business email compromise fraud. I ask the Council to amend the standard so that it says clearly what happens after a report. The provider should acknowledge it promptly, start recall and tracing without waiting for every document, tell the customer what evidence is needed, and give a reasoned decision within a defined period. Where the money has crossed a border, the response should not stop at the border.

The standard should also distinguish between a customer who intended to pay a genuine recipient and a customer who was tricked into paying a criminal. A small business should not lose access to review simply because its authorised user pressed the button. Decisions should consider the deception, the steps the business took, how quickly it reported the payment, and what the sending and receiving providers could do. Reimbursement rules should be clear enough to use, with a fair way to challenge a refusal.

I support practical checks and shared responsibility. I do not support a rule that turns every missed warning sign into an automatic reason to reject a claim. Please make the standard specific about timelines, evidence, cross-border cases and appeal. The businesses giving evidence should be able to see how their experience changes the draft. A fast, fair process would not undo the fear of seeing R64,800 leave an account. It would mean that reporting the fraud is the start of a response, not the end of one.