Invoice fraud in the UK: a guide for small businesses

Invoice fraud is when a criminal gets your business to pay a real bill into the wrong bank account, or pay a bill that was never owed. It doesn’t need clever hacking on your side. It needs one email that looks right, one busy afternoon, and one payment that nobody double-checked.

UK Finance’s Annual Fraud Report 2026 counted £41.3 million lost to invoice and mandate scams in 2025, across 2,305 confirmed cases. About two thirds of that money (£28 million) came out of business accounts rather than personal ones. Only 48% of the losses were returned to the victims.

How invoice fraud usually works

UK Finance describes it simply: you try to pay a genuine supplier, and the criminal steps in and gets the money sent to an account they control. In practice it comes in a few shapes.

• The “new bank details” email. A supplier you really use seems to tell you their account has changed. The invoice is right, the amount is right, only the sort code and account number are new.
• The hacked mailbox. The fraudster has got into your supplier’s email, or yours, and replies inside a real thread. Because the conversation is genuine, nothing feels off.
• The look-alike address. The email comes from a domain one letter away from the real one, or from a free webmail account using the supplier’s name.
• The invoice you never ordered. A bill for directory listings, web services or “renewals”, sent in the hope that someone pays it without asking.
• The “boss” email. A message that seems to be from a director, asking for an urgent payment or a change to a supplier’s details. UK Finance found CEO scam cases fell in 2025, but they had the highest average loss of any type it tracks: just over £28,000 per case.

Warning signs on an invoice or email

• The bank details are different from last time, for any reason at all.
• The payee name, sort code or account number doesn’t sit with the business name: a personal name, or an account with a bank or payment app the supplier has never used.
• The sender’s address is slightly off, or the reply-to address is different from the one it came from.
• There’s urgency: pay today, a penalty, a director “in a meeting” who can’t be phoned.
• The email asks you to confirm by email only, or gives a new phone number to ring.
• Small changes to a familiar invoice: a different logo size, font or VAT number layout.

Five checks that stop most of it

• Phone before you change any bank details. Use a number you already had: an old invoice, your accounts system, the supplier’s website. Never the number in the email. Read the new details back to them.
• Use Confirmation of Payee properly. When you set up a new payee, your bank checks the name you type against the account. It will say match, close match or no match, or that it couldn’t check. Don’t pay through a “no match”, and be wary of anyone who tells you to ignore one. A match is a good sign, not proof: a fraudster can open an account in a name close to your supplier’s.
• Two people for new payees and big payments. One person sets up the payment, another approves it after checking how the details were confirmed.
• Check new suppliers on Companies House. If a limited company you’ve never dealt with sends an invoice, look it up on the Companies House register before you pay. It’s free, and shows whether the company is live, its registered office and its directors.
• Lock down your own email. The National Cyber Security Centre’s guidance on business email compromise tells smaller firms to turn on two-step verification, train staff to spot phishing, give people only the access they need, and limit what’s public about who pays the bills.

Will the bank refund us?

Maybe, but don’t plan on it. Since 7 October 2024, the Payment Systems Regulator’s reimbursement rules have covered authorised push payment scams made by Faster Payments or CHAPS, up to £85,000 per claim. The rules protect personal accounts, charities and micro-enterprises: firms with fewer than 10 staff and a turnover or balance sheet of no more than €2 million. You need to claim within 13 months of the last payment, and banks may take off an excess of up to £100.

If your business is bigger than that, the mandatory rules don’t apply. Any money back depends on how fast the receiving bank can freeze it, and on your bank’s own decision. That’s why the checks before payment matter more than anything after it.

If you’ve already paid a fake invoice

• Ring your bank straight away. Use the number on your card or statement, or call 159. Ask them to contact the receiving bank and try to recover the money. Hours matter.
• Report it to the police. In England, Wales and Northern Ireland that’s Report Fraud, which replaced Action Fraud: online at reportfraud.police.uk or on 0300 123 2040. In Scotland, call Police Scotland on 101.
• Tell the real supplier, on a number you trust. If their mailbox was hacked, other customers are being targeted too.
• Secure your email. Change passwords, turn on two-step verification and check for forwarding rules you didn’t set up.
• Forward any suspicious emails you haven’t acted on to report@phishing.gov.uk.

Make checking the normal thing

Knowing the signs isn’t enough on its own. Checks get skipped when the routine slips: the person who usually checks is off, or the email arrives at ten to five on a Friday. Write the rule down, tell your suppliers you always ring before changing bank details, and give your accounts team something quick to check against when they’re unsure.

Sources: UK Finance Annual Fraud Report 2026; UK Finance: Fraud Report 2026 press release; UK Finance: Confirmation of Payee; Payment Systems Regulator: APP scams reimbursement decision; Nationwide: PSR mandatory reimbursement rules; FCA Handbook: micro-enterprise definition; GOV.UK: Searching the Companies House register; GOV.UK: Report Fraud, new service from City of London Police; Stop! Think Fraud: reporting fraud; NI Cyber Security Centre: Report Fraud; NI Business Info: NCSC guide on business email compromise.

Common questions