Invoice Fraud UK: How to Verify a Payment Safely

An unsolicited change-of-bank-details request always needs an independent phone check.

By Alex Bacsa · Published 2026-04-30 · Updated 2026-08-01 · 5 min read

What invoice fraud looks like for a UK business

This scam is an email that appears to come from a genuine supplier's finance contact, saying their bank details have changed and asking for the next payment to go to a new account. An example of the style is: Please note our bank details have changed with immediate effect due to an internal audit. Kindly update our account details before processing the attached invoice. It's often sent to coincide with a real, expected invoice.

Why these emails are convincing

The National Cyber Security Centre describes this as Business Email Compromise (BEC) — unlike bulk phishing, it's often researched and targeted at a specific business, sometimes using a sender domain only one or two characters different from the real supplier's, and sometimes sent from the supplier's own mailbox after it's been compromised. Either way, it can look exactly like normal supplier correspondence.

Signs an invoice or payment change is fraudulent

• A change-of-bank-details request with no prior verbal confirmation from someone you know at the supplier.
• Urgency or secrecy — being told to process it quickly, or not to mention it to colleagues.
• A sender domain that's subtly different from the supplier's real one.
• An invoice for goods or services your business never ordered.
• A request addressed unusually specifically to one individual, rather than your normal finance inbox.

How the scam works step by step

First, a criminal gains sight of genuine invoice or supplier correspondence — sometimes through a breach, sometimes by closely mimicking a known supplier's usual emails. Second, a bank-detail-change request is sent, timed to land around a real, expected invoice. Third, if it isn't independently verified, the payment goes to the fraudster's account instead of the genuine supplier's — and by the time the real supplier chases the missing payment, the money is usually already gone.

How to verify a payment or bank-detail change safely

Confirm any new or changed bank details through a separate, trusted channel — a phone number you already hold or have independently obtained, never one taken from the change request itself.

• Where your bank offers Confirmation of Payee, use it — and investigate a close match, no match, or unavailable result rather than being persuaded to ignore it.
• For higher-risk payments, use a two-person approval process, and consider sending a small test amount first and having the intended recipient confirm receipt before sending the balance.

What protection applies if it happens anyway

The Direct Debit Guarantee covers errors in the setup or collection of a genuine Direct Debit — once an error is established, you're entitled to a full and immediate refund from your bank or building society. It does not cover standing orders or bank transfers, and it isn't a general remedy for every payment dispute; a refund that wasn't properly due can also be reclaimed.

Most cases of this fraud happen by standing order or a one-off or recurring bank transfer instead. For qualifying UK Faster Payments and CHAPS claims made on or after 7 October 2024, mandatory reimbursement rules generally provide a maximum of £85,000 per claim, with an optional excess of up to £100 (which cannot be applied to a vulnerable consumer), covering individuals, micro-enterprises, and charities with an annual income below £1 million, subject to the scheme's rules and exclusions. A micro-enterprise employs fewer than 10 people with turnover or a balance sheet not exceeding €2 million.

A larger business is outside this mandatory scheme, though some small businesses beyond the micro-enterprise definition may still be able to complain to the Financial Ombudsman Service under its own separate rules. No refund should be assumed automatic — it depends on the payment method, date, claimant, and facts of the case.

If you've already paid a fraudulent invoice

Contact your bank immediately to ask about recalling the payment — acting fast matters, since the chance of recovery drops quickly once funds move on. Report it as soon as possible; delaying reduces the chance of getting the money back.

How to report invoice fraud (UK)

Report it to Report Fraud at reportfraud.police.uk or 0300 123 2040 if you are in England, Wales, or Northern Ireland (this fraud type is often listed as 'mandate fraud'). In Scotland, report to Police Scotland on 101. If a phishing email was involved, forward it to report@phishing.gov.uk.

Frequently asked questions

Sources checked

• NCSC — Business payment fraud (Business Email Compromise)
• Direct Debit — The Direct Debit Guarantee
• Payment Systems Regulator — APP fraud reimbursement protections
• Report Fraud — reporting a fraud, and who the service covers
• Police Scotland — contact us: non-emergencies on 101

Reporting routes in this guide are checked against our verified canon of official UK sources — Report Fraud for England, Wales and Northern Ireland, or Police Scotland on 101 for Scotland, the National Cyber Security Centre, and the consumer service for each nation — by an automated accuracy gate before publication. Editorially updated by Alex Bacsa, Founder & Editor, on 2026-08-01. Read about how Beat the Scam writes guides.