Interception: Changing the Address Between Invoice and Payment

The address on an invoice is a long string nobody memorises. That makes it the easiest field to change and the hardest to notice. The thing being imitated in most of these cases is a provider like a regulated stablecoin payment processor, which is worth knowing the real version of.

Three interception routes

The compromised mailbox. The attacker reads the thread and sends a replacement invoice with a changed address, from the genuine account.

Clipboard malware. Software on either party’s machine watches for a copied crypto address and substitutes one of its own. The payer copies the correct address and pastes a different one.

A modified document. The invoice is intercepted in transit and the address changed. Less common with encrypted transport and still occurs with shared drives and forwarded attachments.

Why both parties see what they expect

The payer sees an address in an invoice from the right person and pastes it.

The supplier sees nothing until the payment does not arrive.

The only observable anomaly is a string that looks like every other string of its kind.

The confirmations that work

Out of band verification. Confirm the address by telephone, to a number you already hold, before any first payment or any change. One call. It defeats all three routes.

Registered addresses. The address is agreed once, when the relationship is established, and stored. Payments go only to the stored address. A change requires the same approval as adding a new supplier.

Compare the whole string. If you must check visually, compare the entire address, not the first and last characters. Attackers generate addresses matching at both ends because that is what people check.

A test payment. Small amount, confirm with the recipient that it arrived, then send the rest. Defeats clipboard substitution, which usually replaces every address.

Clipboard malware specifically

It is worth understanding because it targets the payer rather than the correspondence.

The malware sits on the machine and monitors the clipboard. When it detects something matching the pattern of a crypto address, it replaces it with one from its own list, matching the format. Where funds belong to clients, the requirements are stricter, and ecommerce payment solutions with crypto settlement is structured for that.

The defence is to verify after pasting, comparing against the source. Or to use a wallet that supports address books, so the address is selected rather than pasted.

For a business

Make out of band confirmation mandatory for any new or changed payment address. Write it into the payment procedure, not into a guideline.

Enforce the registered address list technically, so a payment to an unregistered destination cannot be created rather than merely being discouraged.

And tell suppliers your policy, so that when they change their address they expect a call and are not surprised by it.

The realistic assessment

This attack is common, well understood, and preventable by one phone call. Companies that lose money to it almost always had the control written down somewhere and not applied under time pressure. If you want to see these protections operating rather than described, the published coverage list is bound by them.