27 October 2026 · By Chris Kirby

Invoice fraud: how fake bank details cost UK small businesses millions

It's one of the most ordinary emails a business can get. A supplier you've used for years writes to say they've changed banks, and could you please pay this month's invoice into the new account. The logo is right, the tone is right, and the invoice number matches the one you were expecting.

Except the supplier never sent it.

This is invoice fraud, and it's one of the most common and costly crimes facing UK businesses. It doesn't need clever hacking. It needs one convincing email, arriving at the right moment, to the person who pays the bills.

How big is the problem?

Last month, the City of London Police warned businesses and the public that victims of payment diversion fraud lost more than £101 million in the 2025/26 financial year. Report Fraud, the national reporting service, received 3,657 reports of it, a 3% rise on the year before (Report Fraud).

Payment diversion fraud is the umbrella term for tricking someone into sending money to the wrong bank account. Invoice fraud is the most common type, making up 813 of those reports. In these cases, criminals send amended invoices or pretend to be a genuine supplier and ask for money to go into a different account (Report Fraud).

The sums involved in each case can be large. In January the National Crime Agency (NCA) and NatWest launched a joint campaign on invoice fraud, citing figures showing that in September 2025 alone, invoice fraud victims lost £3.9 million across 83 cases, an average of more than £47,000 each (NCA).

For a small business, a loss like that isn't an inconvenience. As the NCA's Nick Sharp put it, "Businesses can be destroyed by a loss of cashflow from a fraudulent payment" (NCA).

Why small businesses are in the firing line

It would be easy to assume this only happens to big companies with big finance teams. The evidence says otherwise.

The government's Economic Crime Survey found that fake invoice fraud was the most common type of fraud experienced by UK businesses with employees, affecting 11% of them, followed by mandate fraud, where criminals get a business to change a supplier's bank details, at 7% (GOV.UK). The Federation of Small Businesses has also found invoice fraud to be the type of fraud small firms report most often (FSB).

The City of London Police said the construction sector recorded the most reports among businesses, and that smaller organisations may be particularly vulnerable because they have fewer resources for cyber security and checking payments (Report Fraud). In a small firm, the person who opens the post, answers the phone and pays the invoices is often the same person, and they're busy.

How the scam works

There are a few common ways in, and they all rely on trust.

A hacked email account. Criminals get into the real email account of a supplier, a customer or someone inside your business, often through a phishing email that steals the password. Then they wait quietly, reading messages until an invoice is due, and step in with a reply in the same thread. Because it genuinely comes from the right address, it looks completely normal.

A lookalike address. Instead of breaking in, the criminal registers a domain that's almost the same as the real one, perhaps with one letter swapped, and writes from there. At a glance, on a phone screen, it's easy to miss.

A spoofed address. Sometimes criminals don't need a lookalike at all. If a business hasn't set up its email protection properly, it can be possible to send an email that appears to come from that business's exact address. We explained how in can scammers send emails pretending to be your business?

Detective Superintendent Oliver Little of the City of London Police summed it up: "Payment Diversion Fraud is a highly effective form of fraud because it exploits trust." He also warned that criminals are increasingly using technology to make their fraud look more convincing, and the force says artificial intelligence is helping criminals mimic writing styles and even impersonate voices and video calls (Report Fraud). Our post on the Arup deepfake video call scam shows how far that can go.

It's not just about what you pay

There's a second side to this that's easy to overlook. Your business isn't only a possible victim. Your name can be used as the bait.

If a criminal can send an email that looks like it came from you, your customers are the ones who might pay a fake invoice. They lose money, and you may lose a customer, your reputation, and the payment you were actually owed. Report Fraud also notes that criminals are now targeting the online booking and ordering systems used by hotels, restaurants and other service businesses, diverting customer payments away from the genuine business (Report Fraud).

That's why the settings attached to your domain name matter. Records known as SPF, DKIM and DMARC tell the world's email systems which messages genuinely come from you. The NCSC recommends them because they make it much harder for anyone else to send email in your name.

The simplest defence is a phone call

The police and the NCA give the same core advice: if a request comes in to change bank details, or you're being pressed to pay urgently, check it by contacting the supplier on a phone number you already know, not one in the email. The NCA and NatWest campaign sums it up as "Check, Verify, Never": check for changes, verify them with a trusted contact, and never transfer money until you're satisfied (NCA).

If the worst happens, contact your bank straight away, and report it to Report Fraud online or on 0300 123 2040 (Report Fraud).

Where do you stand?

You can't control every email your suppliers send. But you can make sure your own domain isn't an easy tool for criminals who want to pretend to be you.

Tidy Cyber's free check looks at your domain from the outside and tells you, in plain English, whether your email spoofing protection is in place, along with your website security, certificate and domain basics. Run the free check on tidycyber.co.uk and find out where you stand in a couple of minutes.