# Why can't a network security tool stop invoice fraud?

Because invoice fraud happens in conversations and decisions, not in network traffic. The fake invoice arrives as an ordinary e-mail in a cloud mailbox; the person who pays it uses online banking as on any other day; and no malware has to run anywhere. From the network's point of view, everything is normal. A network detection and response (NDR) tool watches how devices behave: which machines talk to which, regular check-ins with outside servers, internal scanning, unusual data volumes. It does not read e-mail text, and it cannot know that an account number is wrong. That is not a weakness to hide but a boundary to plan for. Invoice fraud is stopped by payment controls, by e-mail authentication on your own domain, and by people who are allowed to pause and call back. NDR becomes relevant only when the fraud starts with an intrusion, for example a hacked mailbox used to get into other systems.

FAQ: [Phishing and e-mail aftermath](https://netsenx.com/en/faq/phishing) · https://netsenx.com/en/faq/why-cant-a-network-tool-stop-invoice-fraud

## Read next

- https://netsenx.com/en/is-someone-inside-your-network
- https://netsenx.com/en/what-is-ndr

## Related questions

- [Someone is sending fake invoices in our company's name. What can we do?](https://netsenx.com/en/faq/someone-sends-fake-invoices-in-our-name)
- [How do we stop criminals sending e-mail that pretends to come from our domain?](https://netsenx.com/en/faq/how-to-stop-someone-spoofing-our-email-domain)
- [What is DMARC?](https://netsenx.com/en/faq/what-is-dmarc)
- [What is MFA fatigue?](https://netsenx.com/en/faq/what-is-mfa-fatigue)
- [Can phishing get past multi-factor authentication?](https://netsenx.com/en/faq/can-phishing-bypass-multi-factor-authentication)