Invoice fraud happens when a criminal poses as a supplier, usually by email, and gets you to pay a genuine-looking invoice into their bank account. The best defence is a rule that any new or changed bank details are confirmed by phone, on a number you already had, before anyone pays. Businesses with ten or more staff aren't covered by the bank reimbursement rules, so prevention matters more than recovery.
In this article
The short version
- Invoice fraud usually arrives as a fake invoice or a change of bank details.
- Always confirm new or changed details by phone on a number you already had.
- Call your bank first if you've paid, then report to Action Fraud.
- Bank reimbursement only covers individuals, charities and micro-enterprises.
- Payment links and direct debit keep bank details off your invoices.
How invoice fraud works
It goes by several names, including payment diversion fraud and mandate fraud, but the pattern is the same. A criminal gets into a supplier's email account, or sets up an address that looks almost identical, and then either sends a fake invoice or tells you the supplier's bank details have changed. The invoice looks right, the amount is often one you expect, and the money goes to an account the criminal controls.
UK Finance figures for 2025 put losses from invoice and mandate scams at £41.3 million, down 4% on the year before. Businesses carried £28.0 million of that, and 48% of the money lost was returned to victims. UK Finance notes that because businesses make large genuine payments regularly, a fraudulent one is harder to spot.
The warning signs the National Crime Agency highlights are worth putting in front of everyone who pays invoices:
- a request to make a large or unusual payment urgently
- a request to change a supplier's bank details, or to set up a new supplier
- an email whose tone or wording doesn't sound like the sender
- spelling mistakes, or an email address that's slightly different from the usual one
Checks that stop it
The single most useful control is a callback. Before paying to new or changed bank details, phone the supplier on a number you already held, from your own records or a previous contract. A number on the invoice or in the email footer came from whoever sent it, so it proves nothing.
Other checks that make fraud harder:
- Confirm any change to payment details through a second channel, such as a phone call or a message on a system you already use, never by replying to the email that asked for it.
- Treat a change of bank details as suspicious by default. Genuine suppliers change banks far less often than fraudsters claim to.
- Use dual authorisation for payments over a value you choose, so two people have to approve them.
- Match invoices to purchase orders or agreed work before paying.
- Add a verification step when you set up a new supplier, not just when one changes.
- Read the Confirmation of Payee result your bank shows you. A no match on a supplier you've paid before is a reason to stop. A match only means the name and account go together, though, not that the supplier is genuine.
What to do if you've paid a fraudulent invoice
Act quickly, ideally within the first hour:
- Call your bank on the number from its official website or the back of your card, never a number from the email, and ask it to try to stop or recover the payment.
- Tell whoever runs your IT. The compromised mailbox may still be live, and the same trick could be used on your next payment.
- Report it to Action Fraud, or to Police Scotland on 101 if you're in Scotland, and report a cyber incident through GOV.UK if your own systems were involved.
- Tell the genuine supplier, whose mailbox may be the one that was compromised, and keep the original emails.
Whether your bank has to refund you depends on your size. Since 7 October 2024, payments sent by Faster Payments or CHAPS have been covered by reimbursement rules for authorised push payment fraud, up to £85,000, as long as the fraud is reported within 13 months. Those rules apply to individuals, charities and micro-enterprises. A micro-enterprise has fewer than ten staff and an annual turnover or balance sheet total of no more than roughly £1.7 million. Group structure counts, so a small subsidiary of a larger group is unlikely to qualify.
If your business is larger than that, there's no automatic right to a refund, and getting the money back usually depends on your bank recovering it before it's moved on. Paying a fraudster also doesn't usually settle what you owe the real supplier, so take advice on your position.
How to protect customers who pay your invoices
Your own invoices can be used against your customers in the same way. A fraudster who gets into your mailbox, or theirs, can send a convincing copy of your invoice with different bank details.
It helps to tell new customers that your bank details won't change, and that they should call you before paying anywhere new.
Payment links and direct debit go further, because your customer never copies your bank details from a document. With a payment link, they pay by card, Apple Pay, Google Pay or pay by bank from a secure page, and with direct debit you collect on the agreed date. Neither stops fraud altogether, since a fake payment link is a risk of its own, but there are no account numbers on the invoice for anyone to change.
Adfin sends payment links by email, SMS or WhatsApp and collects by direct debit from the same invoice, with reminders sent from your own email domain. Its collection agents can chase unpaid invoices within rules you set, so customers get used to receiving payment requests in the same way every time.
Common questions
What is invoice fraud? A criminal poses as a supplier, usually by email, and gets a business to pay a genuine-looking invoice into the criminal's bank account, often by claiming the bank details have changed.
How do I check a change of bank details is genuine? Phone the supplier on a number you already had before the request arrived, not one from the email or invoice, and confirm the change with someone you know.
Will my bank refund my business if we pay a fraudulent invoice? Only if you're an individual, a charity or a micro-enterprise, meaning fewer than ten staff and a turnover or balance sheet total of no more than roughly £1.7 million. The limit is £85,000 per claim.
How long do I have to report authorised push payment fraud? Within 13 months of the payment, under the reimbursement rules. In practice, report it straight away, because recovery gets harder by the hour.
Does Confirmation of Payee stop invoice fraud? Not on its own. It can catch some changed details, but a fraudster with an account in a convincing name can still get a match.
Who should I report invoice fraud to? Your bank first, then Action Fraud, or Police Scotland on 101 in Scotland. If your systems were compromised, also report a cyber incident through GOV.UK.
Sources
- UK Finance - Annual Fraud Report 2026 (accurate as of October 2026) https://www.ukfinance.org.uk/system/files/2026-06/UK%20Finance%20Fraud%20Report%202026.pdf
- National Crime Agency - Payment diversion fraud: what you need to know (accurate as of October 2026) https://www.nationalcrimeagency.gov.uk/who-we-are/publications/574-payment-diversion-fraud-what-you-need-to-know-and-how-to-protect-yourself/file
- NCSC - Business payment fraud: respond and recover (accurate as of October 2026) https://www.ncsc.gov.uk/section/respond-recover/business-payment-fraud
- Payment Systems Regulator - APP fraud reimbursement protections (accurate as of October 2026) https://www.psr.org.uk/information-for-consumers/app-fraud-reimbursement-protections/
- Action Fraud - Mandate fraud (accurate as of October 2026) https://www.actionfraud.police.uk/a-z-of-fraud/mandate-fraud
- Take Five - Protect your business (accurate as of October 2026) https://www.takefive-stopfraud.org.uk/protect-your-business/
