Invoice fraud

You receive an email from someone who’s done some work for you recently – it could be a plumber, or a supplier you’ve worked with for years. They tell you they’ve changed their bank account details and ask you to pay into their new account. Would you do it? Or would you check first?

In 2021, there were 2,555 reported cases of personal invoice and mandate scams (mandates are payment arrangements like direct debits). Businesses reported 1,775 cases, with an average loss over £14,000.

Yet most cases of invoice fraud could be avoided with one simple anti-fraud measure - calling the supplier.

What is invoice fraud?

Invoice fraud is when fraudsters send an invoice, or a request to pay into a new account, claiming to be from a real business you’ve worked with. Sometimes they hack the emails of your supplier to send the invoice, so the email address is genuine but the payment details are changed to those owned by the fraudster.

Always verify new payment details

Email is not a secure way to send or receive payment details, because email accounts can be hacked. To combat invoice fraud, always check new payment details with your supplier directly before you pay into the new account. Whether you’re setting up a new payee or being asked to update existing payment details – check every time.

It should only take a few minutes to check and verify the payment details by calling your supplier on the number you already have for them, or the number on their website (not the one in the email you’re verifying, in case the fraudster has changed that too).

This simple measure could eliminate all cases of invoice fraud.

A phone call to the usual contact at the supplier or service provider is all it takes.

Kirsty McStay, Financial Crime Risk Manager, Triodos Bank

"We’re seeing invoice fraud attacks on our customers. A phone call to the usual contact at the supplier or service provider is all it takes to verify the 'new' bank details and these frauds would have been avoided. Five minutes of your time could make all the difference." - Kirsty McStay, Financial Crime Risk Manager, Triodos Bank

7 useful measures to help prevent fraud

There are several things that you can do to protect yourself from invoice fraud.

Here’s a checklist you can use. If others have access to make payments from your account, share these measures with them and make sure they’re aware of the risks of invoice fraud too:

Check invoices carefully
Anyone who has the authority to pay invoices and change bank details should check supplier names, addresses, invoice amount and bank details to ensure they’re correct.
Verify payment details
Every time you set up a new payee, or if a supplier asks to update their payment details, always verify the payment details with them by calling the number on their website or a previously saved number you have for them.
Follow up invoice payments
When you pay an invoice, let the supplier know the payment has been made, confirming the amount and bank details paid into.
Check bank statements carefully
Report all suspicious debits to your bank immediately.
Call suppliers back
If you receive a phone request to pay an invoice or pay into a new account, say you’ll call the supplier back. Use the number published on their website or the one you previously have saved for them so you know it’s the genuine number you’re calling.
Be careful what you post online
Fraudsters often thoroughly research suppliers so that they can convincingly impersonate them. Be aware of information that you publish online, such as on review websites, or recommendations through social media, or supplier lists on your website.
Make a small test payment
Before making a payment to a new account, transfer a small amount first and call the recipient (on the number published on their website) to check that the payment has been received OK.