How Small Businesses Can Stop Invoice Fraud Before Paying

An email arrives from a supplier you have paid every month for two years. Same logo, same signature, same friendly tone, with one line added: "Please note our bank details have changed, updated invoice attached." If you pay it, the money is usually gone within hours.

Invoice fraud is one of the most expensive scams small businesses face, and it works because it looks like ordinary admin. The good news is that it is also one of the easiest to stop, with a handful of payment checks that cost nothing and take a few minutes. Here is what the scam looks like and the process that blocks it.

How invoice fraud works

There are three common versions. In the first, criminals break into a supplier's email account, often through a phishing link or a reused password. They read months of conversations, learn how invoices are sent, then send one from the real account with new bank details. Because the email is genuine, every technical check passes.

In the second, they register a lookalike domain, such as "brightway-supplies.co" instead of "brightwaysupplies.co.uk", and copy the supplier's style. In the third, they impersonate your own boss or owner, asking the bookkeeper to make an urgent payment before the end of the day.

The amounts vary from a few hundred pounds to six-figure sums. Small businesses are attractive targets because one person often handles both receiving invoices and making payments, with no second pair of eyes. We covered why that matters in why small businesses are easier targets than they think.

Warning signs on an invoice or payment request

Train everyone who touches payments to pause when they see any of these:

• Changed bank details. This is the single biggest red flag. Genuine suppliers change banks rarely, perhaps once in several years.
• Urgency or secrecy. "Must be paid today", "please keep this between us", "I am in a meeting so just email back".
• A slightly different sender address. Hover over or tap the sender name to see the full address. Look for swapped letters, extra words or a different ending.
• Replies going somewhere else. When you hit reply, the "to" address is different from the one the email came from.
• Odd timing. Requests sent late on a Friday, just before a holiday, or when the person who normally approves payments is away.
• An account name that does not match. Many UK banks now run Confirmation of Payee, which warns when the account name does not match the business name you entered. Never ignore that warning.

Payment checks that stop invoice fraud

These controls take about an hour to set up and a couple of minutes per payment after that.

1. Verify every bank detail change by phone

When a supplier asks to change bank details, call them on a number you already hold, from a previous invoice, your accounts system or their website. Never use a number from the email asking for the change. Ask a specific question, such as the amount of the last invoice, and note who you spoke to and when.

2. Use two-person approval above a threshold

Set a limit, for example 1,000 pounds, above which a second person must approve the payment. Most business banking apps support dual authorisation for free. In a two-person business, the owner approves. If you work alone, set a rule to wait 24 hours before paying any new or changed payee.

3. Send a small test payment to new accounts

For a new payee, send 1 pound first and ask the supplier to confirm, by phone, the exact amount that arrived. It adds a day but makes paying the wrong account very unlikely.

4. Lock down your own email

Turn on two-factor authentication for every mailbox that sends or receives invoices, so a stolen password alone is not enough. Our guide to passkeys covers a stronger option that most business email services now support.

The counter-take: email security tools will not save you here

A common response to invoice fraud is to buy a better spam filter or email security product. These tools are useful for many threats, but they are poor at this one.

When the fraudulent invoice comes from your supplier's real, compromised mailbox, it passes every check: correct domain, valid signature, a thread history going back months. There is no malicious link or attachment to detect, only a polite message with new numbers. No filter can know that the numbers are wrong.

The control that works is a process, not a product. The phone call and the second approver catch what software cannot, because they check the request through a channel the criminal does not control. Spend your budget on making that process easy to follow, not on another filter.

What to do if you have already paid

Speed matters more than anything else. Funds are often moved on within hours.

1. Call your bank immediately using the number on your card or banking app. Ask them to recall the payment and contact the receiving bank. Do this before anything else.
2. Report it. In the UK, report to Action Fraud. Elsewhere, contact your national fraud reporting service or the police.
3. Warn the real supplier. Phone them on a known number. Their email is likely compromised and other customers may be targeted.
4. Secure your email. Change passwords, check for forwarding rules you did not create and review recent sign-ins.
5. Keep the evidence. Save the emails, invoice and payment records. Your bank and insurer will need them.

Check whether your business insurance covers social engineering fraud. Many standard policies do not unless it was added specifically.

Make the process easy to follow

Write the rules on a single page and keep it next to whoever handles payments. Add it to onboarding for new staff, and remove payment access promptly when someone leaves, as part of offboarding an employee securely. The best invoice fraud defence is one that nobody needs to remember under pressure, because it is just how payments are done.

Frequently asked questions

How do I know if an invoice is fake?

Look for changed bank details, urgent language, a slightly different sender address or a reply address that does not match. Even if everything looks right, verify any new or changed bank details by phone on a number you already hold.

Can a bank reverse a payment made to a scammer?

Sometimes, if you act quickly. Contact your bank immediately so it can try to recall the payment before the money is moved on. The chance of recovery falls sharply after the first few hours.

Who is responsible if we pay a fraudulent invoice?

It depends on the circumstances and your contracts, and often the paying business carries the loss. If the supplier's email was compromised, responsibility may be disputed. Clear verification procedures strengthen your position and are the best way to avoid the loss in the first place.