Invoice fraud, also called payment diversion or business email compromise, is when a criminal persuades you to pay a genuine bill into their bank account. It usually arrives as a convincing email saying a supplier’s bank details have changed, often sent from the supplier’s own hacked mailbox. The single most effective defence is simple: never change a payee’s bank details on the strength of an email. Call them back on a number you already hold. Here’s how the fraud works, what the figures show, the settings that make it harder, and what to do if it happens to you.
How payment-diversion fraud works
- Getting in. The criminal tricks someone into typing their email password into a fake login page, or registers a lookalike domain that’s one letter different from a real supplier’s.
- Watching. With access to a mailbox, they read the conversations, learn who pays whom and when, and often set up hidden inbox rules that forward copies of emails or move replies out of sight.
- Striking. At the right moment they send an invoice or a “change of bank details” message, usually inside a real email thread, often with a reason to hurry.
- Cashing out. The money is moved on quickly, which is why speed matters so much if you’ve paid.
A close relative is CEO fraud, where the criminal poses as a director and asks a member of the finance team to make an urgent payment to a new account.
How big is the problem?
UK Finance’s Annual Fraud Report 2026, covering 2025, recorded:
- £41.3 million lost to invoice and mandate scams across 2,305 cases, which works out at almost £18,000 per case
- £28 million of that (68%) on business accounts. UK Finance notes that businesses make genuine high-value payments regularly, which makes a fraudulent one harder to spot
- only 48% of invoice and mandate scam losses returned to victims
- £5.6 million lost to CEO fraud across 197 cases, an average of just over £28,000 per case, the highest of any scam type
Invoice scam losses were the lowest UK Finance has ever recorded, and CEO fraud losses the lowest since 2020, which it puts down to investment in fraud prevention and awareness. That’s good news overall, but a single case can still be a serious blow to a small business.
Will the bank give the money back?
Possibly. Since 7 October 2024, the Payment Systems Regulator’s reimbursement rules have covered bank transfers made by Faster Payments or CHAPS by individuals, charities and microenterprises: businesses with fewer than ten staff and an annual turnover or balance sheet of no more than €2 million. Claims of up to £85,000 can be made within 13 months, unless the victim was complicit or grossly negligent. Larger businesses aren’t covered by these rules, and the NCSC warns that some insurance policies won’t cover money lost through email compromise either. Prevention is far cheaper than recovery.
The checks that stop it
- Call back before any change. For every new payee or change of bank details, phone the supplier on a number from your own records or contract, never one in the email. The NCSC recommends verifying important email requests through a second channel, such as a phone call.
- Use two people. One person sets up or changes a payee, another approves the payment. Take your bank’s warning seriously if the account name doesn’t match.
- Protect every mailbox with multi-factor authentication. A stolen password alone then isn’t enough to get in. Passkeys go further, because a fake login page can’t use them: see our guide to passkeys in Microsoft 365.
- Watch for mailbox rules and forwarding. Microsoft lists inbox rules that forward mail to unknown addresses, or move messages into the Notes, Junk Email or RSS Subscriptions folders, as signs an account has been compromised. Microsoft 365 can block automatic forwarding to outside addresses, and someone should be checking for new rules.
- Set up DMARC, SPF and DKIM. These stop criminals sending email that appears to come from your exact domain, which the NCSC recommends. They won’t stop a lookalike domain or a supplier’s hacked mailbox, so they work alongside the call-back rule, not instead of it. Our guide to DMARC, SPF and DKIM explains how they fit together.
- Train the people who pay bills. They should know your normal payment process well enough to spot an exception: new bank details, urgency, secrecy, a slightly different email address. Make it clear that checking is always welcome.
- Tell your own customers. Put a line on your invoices saying your bank details will never change by email, and that they should call you if they’re asked to pay somewhere new.
What to do if it happens
- Call your bank immediately, using the number on its website or your card. The sooner it knows, the better the chance of stopping or recovering the payment.
- Tell your IT support straight away. The compromised account needs locking down: password reset, all sessions signed out, unknown sign-in methods removed and any forwarding or inbox rules deleted.
- Report it to the police through Report Fraud (which replaced Action Fraud) if you’re in England, Wales or Northern Ireland: report online at any time or call 0300 123 2040. In Scotland, call Police Scotland on 101. If your business is under a live cyber attack, call 0300 123 2040 straight away: that line runs 24 hours a day.
- Warn the other party. If a supplier’s or customer’s mailbox was used, tell them by phone so they can secure it.
- Check whether personal data was exposed. If it was, and there’s a likely risk to people, you must tell the ICO as soon as possible and, where feasible, within 72 hours.
- Report the phishing email by forwarding it to the NCSC at report@phishing.gov.uk, then check your insurance.
How we help
For businesses on our managed IT service, multi-factor authentication and security best practice are enforced as standard. We tighten the Microsoft 365 security settings that make mailbox takeover harder, set up email security and DMARC properly, and help you build a call-back process your team will actually follow. Our IT security work starts with finding the gaps.
Want a quick view first? Our sister brand AlphaSec offers a free security snapshot that checks your domain’s email spoofing protection from public records. Or book a call and we’ll talk it through.
Sources
- UK Finance, Annual Fraud Report 2026 (invoice and mandate scams, CEO scams)
- Payment Systems Regulator, APP fraud reimbursement protections and Specific Requirement 1 (microenterprise definition)
- NCSC, Phishing attacks: defending your organisation
- NCSC, Business payment fraud
- NCSC, Cyber insurance guidance
- NCSC, Small Business Guide: report the incident
- Report Fraud, Contact us (reporting and the 24-hour live cyber attack line)
- GOV.UK, Cyber security guidance for business
- GOV.UK, Report suspicious emails and websites
- Microsoft Learn, Respond to a compromised email account and Control external email forwarding
- ICO, Personal data breach reporting