Invoice Fraud and Payment Diversion: Controls for Accountants

Invoice fraud does not need a clever hacker. It needs a convincing email, a change of bank details and someone who is busy. For accountants it matters twice over: your clients' accounts payable teams are targets, and so is your own practice, because you hold payment details, process payments and are trusted by the people who ask you to change them. This guide explains how invoice fraud and payment diversion work, what the National Crime Agency (NCA) advises, which controls an accountancy firm and its clients can put in place, and what to do if a payment has already gone to the wrong account. It draws on the NCA's January 2026 campaign with NatWest and on guidance from the Fraud Advisory Panel. It is general information, not legal advice.

What invoice fraud and payment diversion are

The NCA describes invoice fraud as criminals tricking individuals and businesses into paying fake invoices, or redirecting genuine payments into accounts they control, and calls it one of the most common and costly forms of financial crime. Fraudsters may impersonate suppliers, intercept emails, or send convincing invoices designed to get immediate payment into their own accounts. The same pattern is often called mandate fraud or payment diversion fraud. The Fraud Advisory Panel notes that payment diversion often involves business email compromise, where a fraudster takes over a business's email account to redirect payments from staff, suppliers or customers.

How big is the problem?

The NCA's campaign, published on 29 January 2026 and aimed at accounts payable and finance staff, quoted Action Fraud figures. In September 2025 alone, victims lost £3,908,086 across 83 reports, an average of more than £47,000 per case, and invoice fraud accounted for 85 per cent of all payment diversion fraud losses that month. A single month is a snapshot and not a trend, but the average loss is a useful reminder of what one successful attempt can cost a small business.

The NCA's three-word advice

The NCA and NatWest promote an approach they call check, verify, never:

• Check for any change to invoice or bank details, and be wary of pressure for urgent payment.
• Verify changes by calling the genuine supplier on a number you have used before, because emails can be intercepted or diverted.
• Never transfer money until you are satisfied that the details are correct.

Controls for an accountancy practice

The Fraud Advisory Panel's advice, published in 2022 but still sound, adds practical controls. Our suggestions, based on that advice, are:

1. Independent call-back. Verify any payment request or change of bank details by contacting the person using details already held on file, not those in the request.
2. Do not rely on confirmation of payee alone. The Panel recommends independent verbal checks as well.
3. Two people for changes. One person records a change of bank details and another approves it.
4. Strong authentication. The Panel recommends strong passwords, such as the three random words approach, and two-factor authentication for fund transfers and account access.
5. A fraud risk assessment. The Panel recommends a business-wide assessment, using internal audit where available or involving managers otherwise.
6. Test your cyber resilience. The Panel points to the National Cyber Security Centre's exercise in a box tool, which includes exercises for small businesses.

The Panel also warns about impersonation, including fraudsters posing as a chief executive to ask an employee to buy gift vouchers, and fake professional profiles on social networks. Be careful about connection requests from people you do not know.

Payroll and other bank detail changes

The same pattern applies wherever a person asks you to change where money goes. A payroll change request that arrives by email, or a client who suddenly asks to pay a supplier into a new account, should go through the same independent verification. Treat urgency as a warning sign, not a reason to skip a step.

Why it is also a money laundering issue

If a client falls victim and funds have moved, you may need to consider your own reporting duties, and the account that received the money may have been used to launder it. Unexplained urgency, last-minute changes of beneficiary and payments to unfamiliar overseas accounts also appear among the red flags in our guide to money laundering red flags for accountants. If you suspect a payment relates to fraud proceeds, speak to your money laundering reporting officer (MLRO) and see our guide to suspicious activity reports.

Corporate liability for fraud

Larger organisations now face a corporate offence of failing to prevent fraud, which is relevant if your clients are large or your firm advises on controls. See our guide to the failure to prevent fraud offence for accountants for the detail.

If a payment has gone to the wrong account

1. Act immediately. Contact the bank that sent the payment and ask it to start its recovery process. Speed matters.
2. Report it. Report the fraud to Report Fraud, the national reporting service run by City of London Police, which replaced Action Fraud.
3. Tell the client. If it happened on your watch, be open about what happened, and notify your professional indemnity insurer as your policy requires.
4. Preserve evidence. Keep the emails, headers, call notes and payment records.
5. Review the control that failed. Record what changed afterwards.

Training helps. See our CPD courses for finance and compliance training for your team.

Frequently asked questions

What is payment diversion fraud?

It is when criminals redirect a genuine payment to an account they control, often by impersonating a supplier or by taking over an email account. It is also called mandate fraud.

How should I verify a change of bank details?

Call the supplier on a number you have used before, not the number in the email, and never pay until you are satisfied. This is the NCA's advice.

Is confirmation of payee enough?

The Fraud Advisory Panel says not to rely on it alone and to carry out independent verbal checks as well.

Does invoice fraud only affect large businesses?

No. The NCA says it is one of the most common and costly forms of financial crime, and the average loss in the reported month was over £47,000.

Where do I report invoice fraud?

To Report Fraud, which replaced Action Fraud as the national reporting service, and immediately to your bank so it can try to recover the funds.