Invoice fraud is when a criminal pretends to be one of your suppliers and asks you to pay their bank account instead, sending from the supplier’s real email, which they’ve broken into, or from an address one letter off. In 2025, UK businesses lost £28 million to invoice and mandate scams in cases reported to UK Finance, and got back less than 40p in every £1. This short video, told by a villain called Invoice Fraud, shows how it happens and three checks to put in place: phone the supplier on a number you already have, have two people approve any change of bank details, and turn on two-step sign-in for email.
How does invoice fraud work?
The criminal gets into the conversation in one of two ways. They break into your supplier’s real email account, for example with a stolen password, or they send from an address that’s one letter different from the real one. Our guide to email spoofing explains how fake addresses are made to look genuine.
Then they read along and wait for a real invoice. When it’s due, they forward an old email from the supplier with new words on top: our bank details have changed, please use these. Because it arrives as part of a real conversation, it looks like any other invoice. Some people call this business email compromise, and our guide to phishing, spear phishing and whaling covers the emails that often start it.
One of our clients, a distribution business, had a member of staff enter their Microsoft 365 password on a phishing page. The attacker set up silent forwarding rules, watched the mailbox for about a month to learn which suppliers were active and how invoicing worked, then sent emails designed to redirect a large supplier payment. A member of staff noticed the phrasing didn’t match the colleague it claimed to be from and told us before any money moved. Our Microsoft 365 identity protection page tells the full story.
Why is it so hard to get the money back?
Once you’ve paid, the money is in the criminal’s account and your real supplier is still waiting for it. UK Finance’s figures for 2025 show £28 million of invoice and mandate scam losses on business accounts, with £10.6 million returned: less than 40p in every £1.
The UK’s compulsory scam refund rules, in force since 7 October 2024, cover individuals, micro-businesses and small charities. A micro-business has fewer than ten staff, so a business with ten or more staff isn’t covered by the rules.
Warning signs
- New bank details, by email. Stop! Think Fraud, the government’s fraud campaign, says it’s rare for businesses to change bank accounts.
- A rush, such as “can you pay today?”
- An address one letter off from the one you usually see.
- “I’m in meetings, just email.” A request to skip the usual checks, especially the phone call.
What to do about invoice fraud
- Phone the supplier on a number you already have before you pay new bank details, never on a number from the email. Confirm both the old and the new account details.
- Have two people approve any change of bank details, and any large payment. No one person should both approve and pay an invoice.
- Turn on two-step sign-in for email, so a stolen password alone won’t get anyone into your mailbox. Our password re-use video shows how one stolen password can open other accounts too.
Video transcript
Read the full transcript
Invoice Fraud: I’m invoice fraud. I pretend to be your supplier, and ask you to pay my bank account instead.
Invoice Fraud: I break into your supplier’s email, or use an email address one letter off.
Invoice Fraud: Then I read your invoice emails, and forward an old one: our bank details have changed, please use these.
Invoice Fraud: Go on, Sally in accounts, pay my invoice.
Invoice Fraud: The money lands in my account. And your real supplier? Still waiting.
Invoice Fraud: Getting it back is hard. And the compulsory refund rules don’t cover a business with ten or more staff.
Invoice Fraud: My warning signs? New bank details, by email. A rush. An address one letter off. And “I’m in meetings, just email.”
Invoice Fraud: So go on. Try and stop me. I’ll wait.
Narrator: That’s invoice fraud. New bank details? Phone the supplier on a number you already have. Have two people approve any change of bank details, and any large payment. And turn on two-step sign-in for email, so a stolen password alone won’t get them in.
Narrator: Check before you pay. Talk to Ingenio.
Frequently asked questions
What is invoice fraud?
Invoice fraud, which UK Finance calls an invoice or mandate scam, is when a criminal steps into a real payment to a supplier and convinces you to send it to an account they control, often by posing as the supplier and saying the bank details have changed.
What is business email compromise?
Business email compromise (BEC) is when a criminal impersonates someone you deal with regularly, such as a supplier or colleague, and asks you to pay money into a different bank account. The NCSC calls it an example of business payment fraud.
Will the bank refund us if we pay a fake invoice?
Don’t rely on it. The UK’s compulsory scam refund rules cover individuals, micro-businesses with fewer than ten staff and small charities. In 2025, businesses got back less than 40p in every £1 lost to invoice and mandate scams in cases reported to UK Finance. If a payment has already been made, contact your bank immediately, using its official website or phone number.
How do we check a change of bank details is genuine?
Phone the supplier on a number you already hold, not one from the email, and confirm both the old and the new account details. Have a second person approve the change before any money moves.
How do criminals know when an invoice is due?
If they’ve broken into a mailbox, they can read the real emails. In the case on our Microsoft 365 identity protection page, the attacker watched for about a month, learning which suppliers were active and how invoicing worked, before sending the fake request.
Does two-step sign-in stop invoice fraud?
It means a stolen password alone won’t get a criminal into your email, which closes one way in. It won’t stop an email from a lookalike address, so the phone check and two-person approval still matter.
How we help
At Ingenio, we help you turn on two-step sign-in across Microsoft 365, and our Microsoft 365 identity protection service, powered by Huntress, watches for unusual sign-ins and new forwarding rules, the signs an attacker is reading a mailbox. Our KnowBe4 security awareness training gives your team short lessons and simulated phishing emails, so they’re more likely to spot a fake request before they pay it. We’re based in Brighton and support businesses across Sussex and the South East.
Final thought
A change of bank details by email is the moment to stop and phone. One call on a number you already have, and a second person’s approval, give you two chances to catch a fake invoice before the money leaves.
👉 Talk to us about protecting your payments from invoice fraud. We’re happy to talk it through.
