Invoice Fraud Prevention: A Small Business Playbook for UK Firms
Imagine paying a £12,000 supplier invoice on time, in full, and then getting a polite email from your supplier asking why you have not paid. You check your bank. The money went out. It just went to the wrong account, because the invoice you paid was not quite the invoice your supplier sent. Somewhere between their inbox and yours, the bank details changed.
This is invoice fraud, and it is one of the most expensive scams facing UK small businesses. UK Finance figures put invoice and mandate fraud losses at over £49 million in 2024, with 78 percent of those losses hitting business accounts rather than personal ones. The victims are not careless. They are busy people paying genuine-looking invoices through normal processes, and the fraud works precisely because the process looks normal.
The good news is that invoice fraud is unusually preventable. It needs your payment process to have a gap, and a handful of simple controls close almost all of them. This guide is the playbook: what the fraud looks like, the six controls that stop it, a version for sole traders, and what to do in the first hour if money has already left your account.
The three ways invoice fraud happens
Fake invoices. A criminal sends an invoice from a supplier you have never dealt with, often copying a real company’s branding. It relies on nobody checking whether the goods or services were actually ordered. It works best in businesses where invoices are paid without matching them to a purchase order.
Mandate fraud, also called invoice redirection. A criminal impersonates a genuine supplier and tells you their bank details have changed. Sometimes they hack the supplier’s email account, so the message comes from a real address. Sometimes they register a lookalike domain, swapping “.com” for “.co.uk” or adding a hyphen. Either way, the next payment you make goes to the criminal’s account.
Intercepted invoices. A genuine invoice is intercepted in transit, usually by email compromise, and the bank details are altered before it reaches you. Everything else about the invoice is correct: the amounts, the reference, the supplier’s name. Only the destination account is wrong, which is why it sails through a casual check.
All three share one feature: they succeed at the moment someone pays without an independent check. Every control below is aimed at that moment.
Control 1: Never accept a bank-detail change by email alone
This is the single most important rule, and it stops almost all mandate fraud. When a supplier tells you their bank details have changed, do not update your records from the email, and do not call any phone number printed in that email, because the fraudster may have changed that too.
Instead, call the supplier on a number you already hold: your own records, their website, or a number from a previous invoice you have already verified. Confirm the change with a named contact, and ask them to confirm it in writing through a second channel. Then update the record, and note who verified it and when.
Control 2: Require two people for record changes, not just payments
Many small firms require dual authorisation for large payments but none at all for editing a supplier record. That is backwards. Changing the bank details on a supplier record is the attack itself; the payment that follows is just the consequence.
Set a rule: no supplier bank record is created or changed without a second person checking it. The second person verifies the change independently, ideally by making the confirmation call themselves. If you use accounting software, check whether it logs who changed a supplier record and when. That audit trail is also your evidence if a fraud is later investigated.
Control 3: Make a small first payment on any change
Where a change is genuine, sending £1 to the new account and confirming receipt by phone before paying the full invoice costs almost nothing and catches a fraud before the real money moves. Treat any new supplier, or any changed account, the same way: first payment small, confirmed, and only then the full amount.
Pair this with Confirmation of Payee, the name-check service most UK banks now offer. If the account name does not match the supplier’s name, stop. A “close match” or “no match” warning is not a formality to click past; it is the system telling you something is wrong. Never override a no-match warning without a senior decision and a verification call.
Control 4: Match every invoice before it is paid
Fake invoices survive in businesses that pay on trust. Before any invoice reaches the payment run, someone should check three things: was this ordered, was it delivered, and does the amount match the order or quote? A purchase order number on every order makes this check fast. Duplicate invoice numbers, rounded amounts with no breakdown, invoices arriving just before a payment run, and a supplier name that is almost but not quite right are all reasons to pause and check.
Control 5: Protect the mailboxes
Many invoice frauds start with a compromised email account, yours or your supplier’s. If criminals can read your email, they learn your suppliers, your payment dates, and your invoice formats, and they can send a redirection message at exactly the right moment. Worse, if your own mailbox is compromised, your customers become the victims and you become the source.
Turn on multi-factor authentication for every business email account, without exception, and review inbox rules and forwarding settings regularly: a hidden rule forwarding invoices to an outside address is a classic sign of compromise. Train everyone who handles money to recognise phishing, which is often the way mailboxes are first breached; our guide on how to spot and prevent phishing attacks at work covers the warning signs in detail.
Control 6: Keep a clean supplier file
Fraud hides in clutter. Duplicate supplier records, dormant suppliers nobody has reviewed in years, and suppliers with no verified contact details are all hiding places. Once a quarter, review the supplier list: remove duplicates, archive dormant suppliers, and confirm that every active supplier has a verified phone number and bank record on file. When you take on a new supplier, verify their details at onboarding, not at the first payment, and record the verification in your supplier contract paperwork so the agreed payment details are documented from the start. For the wider controls that protect your systems, see our cyber security checklist.
The sole-trader version: when there is no second person
Sole traders cannot dual-authorise with themselves, but the same principles still work with small adjustments. Set a personal payment threshold, for example £500: above it, no payment goes out without a verification call, even if you are busy, even if the supplier is chasing you. Use the £1 first-payment rule for every new or changed account. Keep a trusted phonebook of supplier numbers, separate from your email, so you are never relying on contact details from the message you are checking. And build in delay: a standing rule that urgency triggers a call rather than a payment removes the fraudster’s main lever, because almost every successful attempt carries a reason to hurry.
Red flags worth pausing for
Stop and verify before paying if you see any of these: a change of bank details, especially mid-contract; an email address that is almost the supplier’s domain but not quite; a change in writing style or tone from your usual contact; pressure to pay urgently or outside the normal payment run; an invoice with no purchase order reference where one is normally present; or a request to keep the change quiet, for example “please do not call the office, use this mobile number”. Any one of these is enough to trigger a verification call. None of them is a reason to feel embarrassed about checking; genuine suppliers expect it.
If money has already gone to the wrong account: the first hour
Speed matters more than blame. Act in this order. First, call your bank immediately and ask it to recall the payment and freeze the receiving account if possible; the sooner this happens, the better the chance of recovery. Second, tell the genuine supplier, so they know a fraud is in progress and can warn their other customers. Third, report it to Action Fraud, and to the police if the amount is large, and keep every email, invoice, and bank record: the investigation will need the originals. Fourth, review how it happened and close the gap before the next payment run, because fraudsters often try the same business twice.
Be honest with yourself about recovery. Banks can sometimes recall funds, and authorised push payment reimbursement rules help consumers in some cases, but business payments have weaker protection, and recovery is never guaranteed. Build your controls on the assumption that money sent to a fraudster may not come back.
A one-page checklist to pin above the desk
Before any supplier payment: invoice matched to an order, bank details unchanged or independently verified by phone, Confirmation of Payee passed, second person checked any record change, and no urgency pressure overriding the process. That is the whole playbook, and it fits on one page.
Invoice fraud succeeds when a normal-looking payment skips a normal check. Put the checks in writing, make them non-negotiable even when you are busy, and the most expensive email your business ever receives becomes a five-minute phone call instead of a five-figure loss.