What is invoice fraud?

Invoice fraud is a scam that tricks you into paying a false invoice or using false bank details. A criminal may copy a supplier’s email or use a compromised account. When the scam changes an existing payment instruction, it is often called mandate fraud or payment diversion fraud. 12

By Secordit. Last checked: 7 November 2026.

Go to the steps · All glossary terms

How it works

  1. A criminal impersonates a supplier or intercepts a payment conversation. 12
  2. They send a false invoice or announce changed bank details. 12
  3. A payment intended for the real supplier reaches the criminal. 12

Real UK example

In September 2026, Report Fraud warned about criminals sending amended invoices and impersonating genuine payees. Its analysis also described customer payments being diverted through booking and ordering platforms. 2

Warning signs

  • A regular supplier announces a new bank account. 1234
  • The email address is slightly different from the usual one. 12
  • Someone pressures you to bypass the normal payment check. 1234
  • The request looks familiar but changes where the money goes. 1234

What to do now

  1. Hold the payment while you call the supplier on a number already on file. 1234
  2. If you paid, contact your bank and explain that the destination may be fraudulent. 1234
  3. Keep the invoice, email and payment record for your report. 1234

UK reporting and support

  • If money has gone or banking details were shared, call your bank using the number on your card. Or use 159 if your bank participates. 345
  • Report fraud or hacking in England, Wales or Northern Ireland to Report Fraud. In Scotland, call Police Scotland on 101. 46
  • If someone is in danger, call 999. 6

How to protect yourself

  • Use a written call-back rule for new or changed bank details. 1234
  • Limit who can change payment instructions. 1234
  • Keep supplier contact details separate from an incoming payment request. 1234

Frequently asked questions

What is mandate fraud?

It is payment diversion involving a false change to payment instructions, such as a supplier’s bank details. 1

Can a genuine supplier email account send a scam invoice?

Yes. Criminals can use compromised email accounts. A familiar address does not replace a call-back check. 2

How do I check changed bank details?

Call the supplier using contact details you already hold. Do not rely on the phone number in the change request. 12

Read the longer guide

Matching kit

Bank Details Changed? · £19 · Digital download.

A call-back rule, script and bank-change log for small teams. It does not decide whether a payment is genuine.

General information, not legal, financial or personalised security advice. Secordit is not a police or bank reporting service.

News Pulse

Account security, explained by email.

Read about News Pulse

Sources

  1. Report Fraud, Mandate fraud - Report Fraud. Accessed 7 November 2026 (Europe/London).
  2. Report Fraud, Criminals steal £101 million through Payment Diversion Fraud as City of London Police issues warning to businesses and the public - Report Fraud. Accessed 7 November 2026 (Europe/London).
  3. UK Finance, Authorised Push Payment Fraud Reimbursement | UK Finance. Accessed 7 November 2026 (Europe/London).
  4. Report Fraud, Report Fraud alert: Police forces being impersonated in scam calls using ‘spoofed’ phone numbers - Report Fraud. Accessed 7 November 2026 (Europe/London).
  5. Stop Scams UK, 159 Phone number - Stop Scams UK. Accessed 7 November 2026 (Europe/London).
  6. Police Scotland, How to report a crime - Police Scotland. Accessed 7 November 2026 (Europe/London).