--- title: 'Invoice Fraud: How It Works and How to Stop It' url: 'https://triplepoint.org.uk/guides/invoice-fraud-business-email-compromise' markdown: 'https://triplepoint.org.uk/guides/invoice-fraud-business-email-compromise.md' date: '2026-10-28' description: 'Invoice fraud cost UK businesses £28m in 2025. How business email compromise works, the warning signs, and simple checks that stop a fake payment.' --- # Invoice Fraud: How It Works and How to Stop It ![](https://triplepoint.org.uk/user/pages/guides/invoice-fraud-business-email-compromise/invoice-fraud-business-email-compromise.jpg) **Invoice fraud is when a criminal tricks you into paying a real bill into their bank account, usually with a convincing email, sent from a hacked or look-alike supplier account, saying the bank details have changed.** The most effective defence is simple and free: before paying any new or changed bank details, phone the supplier on a number you already have, never one from the email. ## How big is the problem? UK Finance's [Annual Fraud Report 2026](https://www.ukfinance.org.uk/system/files/2026-06/UK%20Finance%20Fraud%20Report%202026.pdf) recorded **£41.3 million lost to invoice and mandate scams in 2025**, across 2,305 cases. Businesses bore most of it: **£28 million (68%) came from business accounts**, which works out at around £23,000 for each business case. Less than half of all the money lost (48%) was returned to victims. Those are only the cases reported to banks. UK Finance notes why businesses are such good targets: they make genuine large payments regularly, which makes a fraudulent one harder to spot. ## How business email compromise works The attack is patient, and it doesn't need any malware: 1. **The criminal gets into a mailbox.** Usually it's a phishing email leading to a fake sign-in page that captures the password. It might be your mailbox, or one of your suppliers'. 2. **They read quietly.** Sometimes for weeks. They learn who pays whom, when invoices go out, and how people write. Often they add a hidden rule that forwards or files away messages, so they can watch without being noticed. 3. **They wait for the right moment.** A large invoice is due, or a property purchase is about to complete. 4. **They send the request.** "Our bank details have changed, please use the account below." It comes from the real account, in a real email thread, in the right tone. Or it comes from a look-alike address, such as one letter different from the real domain. 5. **The money moves on fast.** Within hours it's spread across other accounts, which is why speed matters if it happens. A close relative is **CEO fraud**, where the email appears to come from your own boss asking for an urgent, confidential payment. UK Finance recorded £5.6 million lost to it in 2025. ## The warning signs Treat any of these as a reason to stop and check: - **A change of bank details,** however routine it sounds. This is the big one. - **Urgency or secrecy:** "needs to go today", "keep this between us", "I'm in a meeting, just do it". - **A slightly different address,** or replies going somewhere other than the sender. Check the full address, not just the display name. - **A new account in a different name,** or a bank warning that the name doesn't match. - **Something out of character:** odd timing, a different sign-off, or a request to skip your usual approval. ## Five checks that stop it 1. **Phone to confirm every new or changed bank detail.** Use a number you already have on file, or from the supplier's website, never one in the email. This single habit stops most invoice fraud. 2. **Have two people approve any bank detail change.** One person updates the details, another checks and approves them. It's harder to fool two people, and it takes the pressure off whoever received the email. 3. **Take bank warnings seriously.** When you set up a new payee, UK banks check whether the name matches the account (Confirmation of Payee). A "no match" or "close match" warning is a reason to stop and phone. 4. **Protect your own email.** Turn on multi-factor authentication for every account, ideally phishing-resistant sign-in such as passkeys, because some phishing kits can continue to work even with MFA in place. [Email security](https://triplepoint.org.uk/security/people-and-email/email-security) catches much of the phishing before it arrives, and [identity threat detection](https://triplepoint.org.uk/security/detect-and-respond/identity-protection) spots suspicious Microsoft 365 sign-ins and forwarding rules. 5. **Tell your own customers how you work.** Add a line to your invoices and email signature: "We will never change our bank details by email. If you receive a request like this, please call us." It protects your customers, and your reputation, if someone ever impersonates you. ## If you've already paid Act in this order, and fast: 1. **Call your bank immediately.** The sooner they know, the better the chance of stopping or recovering the payment. 2. **Report it** to Report Fraud on 0300 123 2040 or at [reportfraud.police.uk](https://www.reportfraud.police.uk), or in Scotland to Police Scotland on 101. 3. **Secure the mailbox,** if it was yours: change the password, sign the account out everywhere, and look for forwarding rules or sign-in methods you don't recognise. 4. **Warn anyone who might have been targeted,** by phone rather than email. 5. **Get help before deleting anything.** Sign-in and mailbox logs show what the attacker saw and did, and they're only kept for a limited time. Our [business email compromise response](https://triplepoint.org.uk/security/incident-response/business-email-compromise) investigates exactly this. Whether you get the money back depends partly on your size. Mandatory reimbursement covers personal accounts, micro-businesses and charities, for payments up to £85,000 made within the UK and claimed within 13 months. Larger businesses aren't covered, which makes the checks above all the more important. Law firms handling conveyancing money are a favourite target, and so are insurance brokers handling premiums and claims, financial advisers arranging withdrawals and transfers, and charities paying grants and suppliers. Our pages on cyber security for [solicitors](https://triplepoint.org.uk/industries/solicitors), [insurance brokers](https://triplepoint.org.uk/industries/insurance-brokers), [financial advisers](https://triplepoint.org.uk/industries/financial-advisers) and [charities](https://triplepoint.org.uk/industries/charities) cover the extra steps for each. If you'd like help tightening up your email security or your payment process, [talk to us](https://triplepoint.org.uk/contact?about=Invoice%20fraud). ## Questions What is business email compromise?+An attack in which criminals take over, or convincingly imitate, a business email account to trick someone into sending money or information. Invoice fraud is the most common form: a real supplier appears to ask for payment to a new bank account. Will the bank refund us?+It depends on the size of your business. The UK's mandatory reimbursement rules cover personal accounts, micro-businesses and charities, for payments up to £85,000 claimed within 13 months. Larger businesses aren't covered, though banks sometimes recover money if they're told fast enough. Can email security stop invoice fraud?+It stops a lot of it: phishing that steals the password in the first place, and look-alike addresses pretending to be a supplier. It can't always spot a request sent from a supplier's real, hacked account, which is why a phone check matters too. Our supplier was hacked, not us. Is it still our problem?+Often, yes. Who should bear the loss between you and your supplier can be disputed, but the payment left your account, and getting it back is slow and uncertain. That's why the checks have to happen on your side, whoever's email was hacked. Where to go next- [Business email compromise response](https://triplepoint.org.uk/security/incident-response/business-email-compromise) - [Email security](https://triplepoint.org.uk/security/people-and-email/email-security) - [Identity threat detection for Microsoft 365](https://triplepoint.org.uk/security/detect-and-respond/identity-protection) - [Phishing simulation & training](https://triplepoint.org.uk/security/people-and-email/phishing-simulation) [< Back to Guides](https://triplepoint.org.uk/guides) ## Not sure what you need? Tell us a little about your business and we'll recommend the controls that will work best for you, with no obligation and no jargon. [Talk to us](https://triplepoint.org.uk/contact) or [See every security area](https://triplepoint.org.uk/security) Our experts spent 20 years at Sophos and include a certified ethical hacker. [More about us](https://triplepoint.org.uk/about) --- ## Navigation - Parent: [Cyber Security Guides for UK Small Businesses](https://triplepoint.org.uk/guides.md) - Previous: [Incident Response Plan for a Small Business (UK)](https://triplepoint.org.uk/guides/incident-response-plan-small-business.md) - Next: [Is It Safe to Use ChatGPT and Copilot at Work?](https://triplepoint.org.uk/guides/is-it-safe-to-use-chatgpt-at-work.md)