Invoice fraud: how small businesses can spot fake bills and diverted payments

Most small business owners worry about hackers breaking into their systems. A far simpler trick costs UK businesses real money every month: a convincing invoice that asks you to pay the wrong bank account. It needs no technical skill from the criminal, and it works because it looks like ordinary admin.

What invoice fraud actually is

The National Crime Agency (NCA) describes invoice fraud as criminals tricking you into paying a fake invoice, or diverting a genuine payment into their own bank account. Fraudsters may impersonate a supplier, intercept emails, or send a convincing invoice to get an immediate payment into an account they control.

It is sometimes called mandate fraud or payment diversion fraud. The pattern is usually the same: a message arrives saying your regular supplier has changed bank, or that a bill is overdue and must be paid today. The invoice looks right, the logo is right and the amount is plausible. Only the account number is different.

How big is the problem?

The NCA and NatWest launched a joint campaign in January 2026 aimed at accounts payable and finance staff. It quotes Action Fraud data for September 2025: invoice fraud victims lost £3,908,086 across 83 cases, an average of more than £47,000 per case. Invoice fraud made up 85% of payment diversion fraud losses that month.

That is one month of reported cases, and it only counts what was reported. But the average loss is the useful number. For a small firm, a loss on that scale is serious.

The warning signs the NCA lists

The NCA's invoice fraud information sheet, produced with NatWest, lists signs to watch for:

• Messages claiming to be urgent, or claiming that payments are late.
• A regular supplier's bank details suddenly changing.
• Invoice details that do not match previous genuine invoices, such as amounts, reference numbers or contact names.
• Minor changes to a supplier's email address.
• Unexpected invoices or payment demands for goods or services you do not recognise.
• Unusual language, grammar or spelling compared with your normal supplier.

The sheet also makes a point worth repeating to your team: invoice fraud is a sign of the sophisticated tactics of criminals, not a sign of your negligence. People who feel embarrassed about being caught out tend to report late, and speed matters.

Check, Verify, Never

The campaign boils the advice down to three words.

• Check for any change to invoice details or bank details, or any pressure for an urgent payment.
• Verify by calling the genuine supplier on a phone number you have used before, before you transfer money, because emails can be intercepted or diverted.
• Never transfer money until you are satisfied that all the details are correct.

The key detail is the phone number. Do not ring the number printed on the new invoice or in the email asking you to change details. Use a published number or a long-standing contact you have dealt with before. The NCA's Fraud page gives the same advice: contact the organisation using details from its official website, not those in the message.

Fake bills dressed up as official ones

Not every fake invoice pretends to come from a supplier. In May 2026, Companies House and the Intellectual Property Office (IPO) jointly warned UK businesses about unsolicited payment requests that falsely appear to come from official government sources, as reported by the IIPLA. They arrive as invoices, by post to a company's registered office or by email, demanding payment for services supposedly provided by Companies House or the IPO. The amounts are often much higher than the official fees, and in some cases the service is free.

The warning says official Companies House and IPO services are only accessed through GOV.UK domains. It also points out that fees you pay to a third-party representative, such as an agent filing on your behalf, are separate from official charges. If you are unsure, contact the organisation or your own authorised representative directly before paying.

Build a simple payment process

You do not need a finance department to make this harder for criminals. The NCA sheet suggests a few controls that fit any small business:

• Always confirm bank detail changes using a published phone number or a long-standing contact.
• Ask another colleague to authorise high-value payments. If you are a sole director, even a trusted bookkeeper or a business partner looking over the payment helps.
• Cross-check any new invoice against a previous genuine one.
• Teach everyone who handles money the warning signs above.

Write the rule down in one paragraph and pin it where the person who pays invoices will see it: we never change supplier bank details without a call to a number we already hold. A rule that is written down is easier to follow when someone is pushing you to hurry.

If you pay lots of invoices, an approval step can also be built into your systems rather than relying on memory. Our process automation work often includes routing payments for a second sign-off, and keeping an audit trail of who approved what.

Keep your accounts secure too

The NCA also notes that vulnerable IT systems can be hacked, and recommends keeping passwords changed and anti-virus software current. The NCA also warns that emails can be intercepted or diverted. Protecting your email with two-step verification is one of the cheapest defences. If you want help reviewing how your business accounts and email are set up, see our cloud and security page.

If you think you have been caught

The NCA's advice is to act immediately:

• Contact your bank straight away and ask them to freeze the funds and the account while an investigation takes place.
• Report it to Report Fraud, either online at reportfraud.police.uk or by phone on 0300 123 2040. Report Fraud launched on 4 December 2025 and replaced Action Fraud as the national platform for reporting fraud and cyber crime. It covers England, Wales and Northern Ireland, and in Scotland you should call Police Scotland on 101.
• Keep all emails, invoices and message trails to support the investigation.

What to do this week

• Agree and write down your rule on changing supplier bank details.
• Decide who gives the second approval on large payments.
• Keep a list of verified phone numbers for your ten biggest suppliers.
• Turn on two-step verification on the email account that receives invoices.
• Tell whoever opens the post at your registered office to treat unexpected official-looking bills with suspicion.

None of this takes long, and the whole approach rests on one habit: pick up the phone before you move the money.