Purchase order fraud occurs when an attacker studies a business's procurement process — supplier relationships, approval formats, documentation style — well enough to place a fraudulent order that passes without question. No system is hacked. No password is stolen. The attacker replicates normal business behaviour using information gathered through observation or prior access. In UAE businesses with informal procurement processes, this type of fraud can go undetected until the supplier chases payment.
The attacker did not need access to a system. They needed access to a process. Every time a supplier visits, an employee observes, or a document is shared, someone learns something about how the business operates. That information — who you buy from, how orders are placed, what the paperwork looks like — is as commercially sensitive as your client list. Most UAE businesses treat it as routine. The businesses most vulnerable to process fraud are those with consistent, observable workflows and no verification layer on top of them.
Do not pay the invoice. Contact the supplier immediately to halt any further deliveries and preserve all documentation — the fraudulent order, delivery notes, and any communications. Check whether other orders have been placed using the same method. File a report with the Dubai Police Economic Crime unit — this is a criminal matter regardless of the amount. Review your supplier communications for the past six months for any other unusual activity that may have gone unnoticed.
In procurement fraud cases we review, the attacker's research period is typically longer than the fraud itself. By the time the first fraudulent order is placed, the process has been observed long enough that everything looks exactly right. The gap is never in the technology. It is in treating business process knowledge as sensitive data rather than operational routine.
