Invoice redirection scams: controls for small businesses
Invoice redirection fraud succeeds because the payment itself can look completely normal. The criminal compromises or imitates a supplier’s email, changes the bank details on a genuine-looking invoice and waits for the business to send money to the wrong account.
Treat every change of supplier bank details as a separate security event. Verify it using a known phone number or established contact, not the contact details in the change email. For large payments, require a second person to check both the account change and the final transfer.
The invoice may be genuine except for one line
A criminal does not need to invent an entire supplier relationship if they can alter the payment instructions. A familiar invoice number, logo, order value and contact name can all be correct while the sort code and account number have been changed.
That is why “the email thread looks real” is not enough. The critical question is whether the new bank details were independently verified.
Start with a real-world test rather than the label on the screen. Picture an £8,750 supplier invoice where an email says the bank details have changed. For 'The invoice may be genuine except for one line', write down the original supplier agreement, previous bank details, email headers, a trusted phone number and the Confirmation of Payee result before changing anything. APP reimbursement protections can apply to eligible Faster Payments scam claims, but prevention still matters because investigations and exclusions can affect the outcome. If the invoice is £8,750, a five-minute independent callback is cheaper than trying to recover the whole payment after a fraudulent change
Verify changes through an old, trusted channel
Call the supplier on a telephone number already held in your accounting or supplier record, or speak to a known contact using an established route. Do not use the phone number in the email announcing the new account; a criminal can change that as easily as the bank details.
For a £28,000 invoice, a two-minute verification call is not bureaucracy. It is a proportionate control against an irreversible mistake.
Treat 'Verify changes through an old, trusted channel' as a sequence of checks. Using an £8,750 supplier invoice where an email says the bank details have changed, separate what is confirmed from what is only assumed, then compare the expected result with the actual result. Keep the original supplier agreement, previous bank details, email headers, a trusted phone number and the Confirmation of Payee result. If the invoice is £8,750, a five-minute independent callback is cheaper than trying to recover the whole payment after a fraudulent change If the evidence does not line up, pause before you create another payment, application or instruction because a second action can make the original problem harder to trace.
Separate the person who changes payee details from the person who pays
Small businesses are vulnerable when one employee can receive an email, change the supplier record and release the payment without another check. Even a lightweight dual-control process breaks that chain.
For example, require one person to record the requested bank-detail change and another to verify it with the supplier before the payment template is amended. The control is especially valuable before quarterly or annual high-value payments.
A useful decision rule for 'Separate the person who changes payee details from the person who pays' is to take one controlled action at a time. Never approve changed supplier details from the same email thread that announced the change. In the example of an £8,750 supplier invoice where an email says the bank details have changed, the next step should preserve the original supplier agreement, previous bank details, email headers, a trusted phone number and the Confirmation of Payee result and leave you able to reverse course if new information appears. Call a known contact using a number from earlier records and confirm the details verbally.
Do not ignore a Confirmation of Payee mismatch
If the bank shows a different account name, stop and resolve it. A fraudster may explain the mismatch as a “new payments company” or “group treasury account”. That explanation might be true, but it should be verified outside the email chain.
Even a correct name match does not prove the invoice itself is genuine, so keep the independent supplier check for any unexpected change.
Build the fallback before the deadline becomes urgent. For 'Do not ignore a Confirmation of Payee mismatch', decide what you will do if the normal route fails: which official channel you will contact, which reference you will quote and what money or account access must remain available. If the invoice is £8,750, a five-minute independent callback is cheaper than trying to recover the whole payment after a fraudulent change Keep the original supplier agreement, previous bank details, email headers, a trusted phone number and the Confirmation of Payee result together in one dated note so support can see the sequence without asking you to reconstruct it from memory.
If the transfer has gone, contact the bank before the email investigation is finished
Report the suspected APP fraud immediately and provide the beneficiary account, amount, time and invoice details. Do not wait for the supplier to complete an internal IT investigation before telling the bank.
Preserve the full email headers and original messages if possible. They can help establish how the redirection happened and support a bank, insurer or police investigation.
Do not treat documentation as paperwork that comes after the problem. Under 'If the transfer has gone, contact the bank before the email investigation is finished', the original supplier agreement, previous bank details, email headers, a trusted phone number and the Confirmation of Payee result are part of the solution because they show the bank what happened and when. Never approve changed supplier details from the same email thread that announced the change. Call a known contact using a number from earlier records and confirm the details verbally rather than improvising with an unverified workaround.
The safest invoice control is independent verification of changed bank details
A convincing invoice can be genuine in every respect except the sort code and account number. Criminals compromise an email account or imitate a supplier, wait for a real payment to become due and then send 'updated bank details'. For any first payment or change of beneficiary, call a known contact using a number already held in your records - not the number printed on the changed invoice or in the suspicious email.
Build a two-person control for meaningful payments. One person enters the beneficiary and another checks the supplier name, amount, invoice number and verified bank details before release. A small test payment is not enough on its own: a fraudster can receive £1 just as easily as £18,000. Confirmation of Payee is useful, but it does not prove the commercial instruction is genuine.
If the transfer has already gone, contact the bank immediately and state that this is suspected invoice-redirection APP fraud. Give the payment reference and preserve the genuine invoice, fraudulent email headers and prior supplier correspondence. Current UK mandatory reimbursement protections can apply to eligible Faster Payments and CHAPS APP scam claims, subject to scope and exclusions.
Finish 'The safest invoice control is independent verification of changed bank details' with a stop condition. Decide in advance what fact would make you wait, what fact would make you contact the bank and what fact would make you abandon the transaction or application entirely. In an £8,750 supplier invoice where an email says the bank details have changed, the safest next step is the one that keeps essential money and evidence recoverable. APP reimbursement protections can apply to eligible Faster Payments scam claims, but prevention still matters because investigations and exclusions can affect the outcome. Call a known contact using a number from earlier records and confirm the details verbally if the provider cannot explain the next step clearly.
Sources and verification
- FCA - Fraudulent payments
- UK Finance - Annual Fraud Report 2026
- NCSC - How to spot a scam
- PSR - APP scam reimbursement rules
Victoria Hughes - Consumer Rights Specialist
Invoice fraud is a process failure as much as an email scam. The durable defence is to make changed bank details impossible to approve from the change email alone. Independent callback plus dual control is far cheaper than recovering a misdirected business payment.
MyBankAnswers uses official provider and UK regulatory sources wherever practical. Information is general and does not constitute financial advice.