Payment Diversion Scams

When Legitimate Payments Quietly Get Hijacked

Jan 23, 2026

Welcome to Cyber Hygiene, my weekly newsletter, where I share tips and actionable data to help everyone stay safe online.

📤 What Exactly Are Payment Diversion Scams?

Payment diversion scams (also called invoice fraud or funds transfer fraud) occur when cybercriminals intercept or impersonate legitimate communications about a payment and trick the victim into sending money to an account the attacker controls instead of the intended party. Unlike malware or ransomware, this attack is about deception and substitution; the money moves, but it goes to the wrong bank account.

At scale, these scams exploit:

Business email compromise (BEC)
Fake vendor invoices
Fake updated bank instructions
Email account takeovers
AI-generated impersonation

🔍 Why Payment Diversion Scams Matter to You

These scams can hit anyone who transfers funds, from individuals wiring money to settle a purchase, to businesses paying suppliers, to real estate closings and nonprofits sending payroll. Unlike “click here” attacks, payment diversion scams can:

Cause large financial losses (tens to hundreds of thousands of dollars per incident)
Compromise trust in financial workflows
Slip past traditional security controls because they rely on trusted channels
Be difficult to recover once the funds are sent

In many cases, victims only realize something is wrong when the bank tells them the funds have been cleared.

📊 Payment Diversion Scams in Numbers

👤 Who Is Behind Payment Diversion Scams?

There’s no single “villain” payment diversion scams are facilitated by a spectrum of actors:

Organized Cybercrime Groups: Professional fraud syndicates that run phishing, BEC, and diversion as a service.
Cybercrime-as-a-Service Operators: Infrastructure platforms (e.g., RedVDS) sell access to disposable servers, phishing kits, and impersonation tools.
Opportunistic Actors: Small groups or individuals who pivot into diversion when automation makes it easy and profitable.
Insider Threats: Employees, contractors, or vendors with legitimate access to payment workflows who manipulate instructions or share sensitive information, intentionally or under coercion.

Their common goal: trick trusting parties during critical payment moments.

🔄 How Do Payment Diversion Scams Happen?

🤖 What Are the Latest Trends

Payment diversion tactics are evolving for three reasons:

1. AI-Generated Impersonation

Attackers can now:

Clone voices
Generate realistic video of executives
Write highly personalized emails This makes impersonation indistinguishable from legitimate contacts.

2. Automation at Scale

Crime services sell turnkey tools: