Fake Invoices and Payment Fraud: Protecting Your Business

Invoice and payment fraud is one of the most common ways criminals take money from small businesses. It often relies on deception rather than attacking your systems: someone persuades a member of your team to pay the wrong account, and by the time anyone notices, the money has gone.

Simple, consistent habits make a real difference. This guide covers the usual tricks, the controls that reduce the risk, and what to do if the worst happens.

The common forms of invoice and payment fraud

• A supplier's email account is compromised. Criminals get into a genuine supplier's mailbox, read past conversations and send a real-looking invoice from the real address. The only change is a note saying the bank details have changed.
• Lookalike email addresses. The address differs from the real one by a letter or two, uses a different ending (.co instead of .co.uk, for example) or swaps a letter for a similar-looking number. On a phone screen these are easy to miss.
• Fake "CEO" or director emails. Someone poses as the owner or a senior manager and asks for an urgent payment, often while supposedly travelling or unreachable. The request usually stresses speed and confidentiality.
• Invoices for things you never ordered. Charges for directory listings, domain renewals, trademark registrations or advertising, sometimes worded to look like official bills.
• AI voice cloning and deepfakes. Short recordings of someone's voice can be used to produce a convincing imitation. A call or voice note that sounds like your boss or a supplier is no longer proof that it is them, and video calls can be faked too.

Common warning signs include pressure to act quickly, a break from normal routine, a request for secrecy and new or changed bank details.

Controls that reduce the risk

You don't need expensive software. You need clear rules that everyone follows, every time, including the owner.

• Never change bank details on the strength of an email. Treat any request to update payment details as suspicious until confirmed another way.
• Always ring back on a number you already hold. Use the number on your existing records or contract, not one in the email or invoice. Caller ID can be spoofed, so if a call came in, hang up and call back yourself.
• Two people approve new payees, changes to existing suppliers' bank details and large payments. One person sets it up, another checks and authorises. Ask your bank how to set this up. If you work alone, verify independently and review the payment again before releasing it.
• Use Confirmation of Payee. When you set up a payee, your bank checks the name you enter against the name on the receiving account.
• Pause anything urgent and secret. Make it clear that staff will never be in trouble for stopping to check.
• Check invoices properly. Confirm the goods or service were ordered and actually delivered, the amount matches, the invoice number looks right and it hasn't already been paid.

On Confirmation of Payee, the result matters. A match means the name fits, but a match is not proof that the invoice, payment request or recipient is legitimate, so it doesn't replace ringing back. A close match means it is nearly right, and your bank will show the actual name. A no match is a serious warning: stop and verify by phone before paying anything. If the check can't be carried out at all, take extra care.

Suspicious emails can be forwarded to the NCSC at report@phishing.gov.uk. That helps take down scam sites, but it doesn't replace contacting your bank or reporting an actual fraud.

Securing your email and domain

Turn on two-factor login (also called multi-factor authentication) for every email account in the business. This makes account takeover much harder. Where available, use phishing-resistant options such as passkeys or security keys. The National Cyber Security Centre (NCSC) has guidance for small businesses on its website.

If you have your own domain, check that SPF, DKIM and DMARC are in place. They help receiving servers spot fake emails claiming to come from your exact domain. They don't stop lookalike domains or messages sent from a genuine mailbox that has been compromised. DMARC also needs correct configuration and an enforcement policy: simply publishing a record isn't necessarily protective. Your email provider or IT support can help, and the NCSC offers free tools to check your setup.

Look out too for unexpected mailbox rules, such as auto-forwarding, which criminals often set up to watch conversations unnoticed.

Your situation may be slightly different. ask a question below ↓ and our editorial team will reply with our advice.

What to do if it happens

1. Call your bank immediately. Use the number on your card or the bank's official website and ask them to try to stop or recover the payment.
2. Report it to the police. In England, Wales and Northern Ireland, use Report Fraud, the national service that has replaced Action Fraud; check police.uk or GOV.UK for the official site. In Scotland, call Police Scotland on 101.
3. Tell the supplier so they can secure their account and warn other customers.
4. Keep evidence. Save emails, invoices, call details and payment information before deleting suspicious rules or messages.
5. Secure your accounts. Change passwords, sign out all active sessions, check recovery details and two-factor methods, remove unauthorised app access, and involve your email administrator or provider.
6. Check whether personal data was involved. If so, you must notify the Information Commissioner's Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to risk people's rights and freedoms. Record every breach, including decisions not to report. If the risk is high, you should generally tell affected people without undue delay too. The ICO website has a self-assessment tool.

Will you get your money back?

Being tricked into sending a payment yourself is known as authorised push payment (APP) fraud. Payment Systems Regulator (PSR) rules for Faster Payments require reimbursement for some business victims, with a parallel Bank of England regime for CHAPS.

Micro-enterprises and small charities are covered. A micro-enterprise has fewer than 10 employees and an annual turnover and/or balance sheet total of no more than €2 million; eligible charities have annual income below £1 million. Larger businesses are generally not covered. The protection applies to qualifying UK-to-UK APP scams, not every payment or commercial dispute, and there are limits, conditions and time limits for claims, so report promptly. Ask your bank how the rules apply, and check the PSR website and GOV.UK for current details.

It is also worth checking whether your insurance covers this kind of loss, as some cyber or crime policies do.

Verify new or changed payment details independently, even when the request appears to come from someone you know.