Invoice fraud: how one changed bank detail empties an SME account

How a payment-diversion scam works

Invoice fraud, also called payment diversion or mandate fraud, is one of the simplest scams there is. Nobody breaks into your bank. Nobody installs anything on your laptop. Someone simply persuades you to send a genuine payment to the wrong account. It usually unfolds in four steps.

1. The attacker gets a view of the conversation

Often they've taken over a mailbox at one of your suppliers, perhaps through an ordinary phishing email, and quietly read along. Sometimes they register a lookalike domain instead, copying names, signatures and invoice formats from earlier emails or the supplier's website.

2. They wait for a real invoice

The clever part is patience. They don't invent a bill. They wait until a genuine invoice is due, so the amount, the reference and the timing all look right.

3. They send the “new bank details” email

Then a short, friendly message arrives, often as a reply in an existing thread. It might come from the supplier's real address, or from one that's a letter or two out.

4. The money goes, and nobody notices for weeks

You pay. The real supplier doesn't chase until the invoice is overdue, which might be a fortnight or a month later. By the time anyone asks “did you pay us?”, the money has usually been moved on, and getting it back is hard.

For a small business, one diverted payment might be a quarter's bill from a key supplier, a deposit on new premises or a month of stock. That's why it's worth a simple, slightly boring process.

The warning signs

Any one of these deserves a pause. Two or more together should stop the payment until you've checked.

• Any change of bank details. This is the big one. Treat every change as unconfirmed until you've checked it by phone.
• A sender address that's almost right. Read the full address, not just the name. Look for swapped letters, extra hyphens or a different ending, like .co instead of .co.uk.
• A deadline. “Our old account closes Friday” or “please pay today to avoid a late fee.”
• A nudge to keep it quiet. “No need to loop in Mark, he's on leave” is a reason to loop in Mark.
• New details in an attachment or link rather than through the way the supplier normally updates you.
• Reluctance to talk. “I'm in meetings all day, email is easier.”

Remember that the email can come from the supplier's genuine address if their mailbox has been taken over. A correct sender is not proof. The change itself is the red flag.

The two-minute check that stops it

The fix isn't technical. It's a short process that everyone who pays bills follows every time, with no exceptions for suppliers you trust or payments that seem small.

1. Pause the payment. Don't pay the new account, and don't reply to the email to check.
2. Find the number yourself. Use a phone number from your own records, an invoice you've already paid or the supplier's contract. Never use a number from the email asking for the change.
3. Ask an open question. “Can you read me the new account details?” rather than “Is it the one ending 4471?” Let them tell you.
4. Write it down. Note who you spoke to, when, and what they confirmed, on the supplier's record.
5. Get a second pair of eyes. If you can, have someone else approve the change before the first payment to the new account.

When you set up the payment, your bank may also show a Confirmation of Payee check, telling you whether the account name matches the name you entered. Treat a “no match” or “close match” as a reason to stop. Don't treat a match as proof on its own, though. The phone call is still the real check.

Write the rule down in one sentence and make sure everyone who can pay a bill knows it: “We never change bank details without phoning the supplier on a number we already have.” Then back people up when they follow it, even when it holds a payment up.

If money has already gone

Act fast. The sooner your bank knows, the better the chance of stopping or recovering the payment.

1. Call your bank now. Use the number on your card, or call 159, which connects you to many UK banks' fraud teams. Ask them to contact the bank that received the money.
2. Report it. In England, Wales and Northern Ireland, report to Report Fraud at reportfraud.police.uk (it replaced Action Fraud). In Scotland, call Police Scotland on 101.
3. Warn the real supplier. Their mailbox may have been taken over. Phone them rather than emailing.
4. Forward the scam email to report@phishing.gov.uk, the NCSC's Suspicious Email Reporting Service. Keep the original, too, as your bank or the police may ask for it.
5. Check your own mailbox. Ask whoever manages your email to look for forwarding rules or sign-ins you don't recognise, and change passwords if anything looks wrong.

Above all, don't blame the person who made the payment. They were targeted by someone who studied your business. What helps is a quick report and a calm look at the process afterwards.

Spotting the pattern gets easier with practice. Lureproof sends small teams realistic practice emails, including an overdue-invoice lure, and turns a click into a 60-second lesson. Our free security training also covers payment fraud, and it's open to everyone.

FAQ