Fake invoice, real loss: how to stop payment diversion fraud

It starts with a normal looking email from a supplier you trust. It ends with your money in a criminal’s account.

Payment diversion fraud, which banks call an invoice or mandate scam, is one of the most expensive things that can happen to a small business. There is no virus and no dodgy download. Somebody in accounts pays a real invoice into the wrong bank account, because an email told them to.

UK Finance reported that invoice and mandate scams cost UK victims £41.3 million in 2025. £28.0 million of that, around two thirds, came out of business accounts, and only £10.6 million of the business losses was returned. Their explanation is blunt: businesses make genuine higher value payments regularly, which makes a fraudulent one harder to spot.

The good news is that a few habits shut it down almost completely.

How the scam works

1. A criminal gets into an email account. Often your supplier’s, sometimes yours. Usually through a phishing email and a stolen Microsoft 365 password.
2. They sit quietly and read. They learn who you pay, how much, when invoices fall due, and how people write to each other.
3. They wait for the right moment, then send an email that looks completely normal. It might come from the real supplier’s mailbox, or from a lookalike address one letter different.
4. The message says the bank details have changed, or attaches an invoice with new account details. It is usually polite, well written and slightly urgent.
5. Your team pays it. The money moves on within hours, and the real supplier is still waiting.

Phishing is how they get in. The government’s Cyber Security Breaches Survey found 43% of UK businesses had a breach or attack in the previous twelve months, and phishing was by far the most common, hitting 38%.

What to look for

• A supplier says their bank details have changed, especially by email only
• Pressure to pay quickly, or a reason they cannot talk on the phone right now
• A sender address that is almost right: a swapped letter, a different ending
• An invoice that looks slightly off compared with their usual one
• Replies arriving from a different address to the one you wrote to
• A request to keep it quiet, or to skip the usual approval

Six checks that stop it

1. Always phone to confirm a change of bank details. This is the one that matters. Call a number you already hold, never the number in the email. Two minutes on the phone stops almost every one of these.

2. Two people for new payees and large payments. One sets it up, another checks and approves. The whole scam relies on catching one busy person on a busy day.

3. Take your bank’s warning seriously. When you add a payee, UK banks check the name against the account. If you get “no match” or “close match”, stop and ring the supplier.

4. Lock down your email. Criminals need a way into a mailbox. Multi factor authentication on every account, automatic forwarding to outside addresses blocked, and inbox rules checked for anything nobody recognises. We cover this on our Microsoft 365 page.

5. Protect your own domain. SPF, DKIM and DMARC make it much harder for anyone to send email that looks like it came from you, which protects your customers from fake invoices in your name. Turning on the external sender tag in Outlook helps your team spot outside email pretending to be internal.

6. Train your team, then test them. Accounts is your last line of defence. Short, regular phishing tests show who might click and who reports it, with no blame attached.

If it has already happened

Speed matters more than anything else.

1. Call your bank immediately, using the number on the back of your card or on their website
2. Report it to Action Fraud at reportfraud.police.uk or on 0300 123 2040
3. Keep everything. The emails, the invoice, the payment details. Delete nothing
4. Change the password on any mailbox that may have been reached, and check it for forwarding rules
5. Warn the supplier. Their mailbox may be compromised and their other customers could be next

How would your team handle it?

Find out safely with a free baseline phishing test. We agree the timing and the email with you, send a realistic simulation to your staff, then talk you through who clicked, who reported it and what to do about it. No blame, no charge.

Sources, accessed 12 October 2026: UK Finance, Annual Fraud Report 2026, for the invoice and mandate scam figures covering 2025. DSIT and Home Office, Cyber Security Breaches Survey 2025/2026. UK Finance, Take Five to Stop Fraud, for reporting advice. Figures were the latest published at the time of writing.