Invoice Fraud and Business Email Compromise: How to Stop It

It usually looks completely ordinary. A regular supplier emails to say they have changed banks, with a new account number for this month's invoice. The email comes from their real address, mentions a real order and is signed by someone you have dealt with for years. You update the details, pay the invoice and think nothing more of it, until the supplier rings to ask why they have not been paid.

This is invoice fraud, also called payment diversion fraud or mandate fraud. It is one of the most financially damaging forms of cyber crime for small businesses, because a single transfer can be worth thousands of pounds and is often hard to recover. This guide explains how it works and the practical steps that stop it.

What is business email compromise?

Business email compromise, or BEC, is when criminals use email to impersonate someone a business trusts in order to steal money or information. It comes in a few common forms:

• Supplier invoice fraud. A real or fake supplier asks you to pay to a new bank account.
• CEO fraud. An email that appears to come from a director asks finance staff to make an urgent, confidential payment.
• Customer payment diversion. Criminals take over your mailbox and send your customers your own invoices with their bank details on them.
• Payroll diversion. An email that appears to come from an employee asks HR to change where their salary is paid.

The UK Government's Cyber Security Breaches Survey 2025/26 found that 12% of businesses had experienced people impersonating their organisation or staff in emails or online in the previous year.

How attackers take over a mailbox

The most convincing scams come from a genuine mailbox that has been taken over, either yours or your supplier's. A typical sequence goes like this:

1. A phishing email leads someone to a fake Microsoft 365 sign in page, and they enter their password. Some phishing kits also capture the MFA code or the signed in session.
2. The attacker signs in quietly and reads the mailbox, looking for invoices, payment runs and the people who handle money.
3. They create inbox rules that hide their activity, for example moving any reply that mentions "invoice" or "bank" into an obscure folder, or forwarding copies to an outside address.
4. They wait for the right moment, then send a request to change bank details, often as a reply in a genuine email thread.

Sometimes the attacker does not need access at all. They register a lookalike domain, such as one with a single letter changed, and send emails that look almost identical to the real thing. See our guide on how to spot a phishing email for the warning signs.

The simplest defence: verify by phone

Technology helps, but the most reliable defence against invoice fraud is a firm process that everyone follows, every time.

• Never change bank details based on an email alone, however genuine it looks and however senior the sender.
• Call the supplier to confirm, using a phone number you already hold from a previous invoice, contract or their official website. Never use a number given in the email asking for the change.
• Ask a specific question the real contact would know, rather than "did you send this?".
• Require a second person to approve any change of bank details and any unusually large or urgent payment.
• Send a small test payment to new details and confirm it arrived, by phone, before sending the full amount.
• Use Confirmation of Payee. Your bank will check whether the account name matches the details you entered. Treat a mismatch or partial match as a serious warning.
• Be wary of urgency and secrecy. Genuine suppliers and directors can wait ten minutes for a phone call.

Write this process down, include it in new starter training and make clear that nobody will ever be criticised for following it, even if it delays a payment.

Microsoft 365 settings that make a difference

Most small businesses run their email on Microsoft 365, which includes strong protections that are not always configured. Ask your IT provider to confirm the following.

• Multi factor authentication is enforced for every user, ideally with number matching or passkeys. Our MFA guide explains the options.
• Legacy sign in methods are blocked, so attackers cannot bypass MFA through older email protocols.
• Automatic forwarding to external addresses is blocked, apart from specific, approved exceptions.
• Alerts are set up for suspicious activity, such as new inbox rules that forward or hide messages, and sign ins from unusual locations.
• External email tagging is switched on, so messages from outside your organisation are clearly labelled.
• Anti phishing and impersonation protection is configured to protect your directors and finance staff by name.
• Audit logging is enabled and retained, so if something does happen, there is evidence to investigate.

SPF, DKIM and DMARC explained

These three records, published in your domain's DNS settings, help receiving mail servers tell whether an email claiming to come from your domain is genuine.

A DMARC policy is usually introduced in stages: first monitoring only, then quarantine, then reject once you are confident all your legitimate senders, such as your accounting software or marketing platform, are set up correctly. DMARC protects your own domain from being spoofed. It does not stop lookalike domains or a genuine mailbox that has been taken over, which is why the phone check above still matters.

What to do if money has already gone

Act immediately. The faster you move, the better the chance of recovering some or all of the money.

1. Call your bank's fraud team straight away, using the number on its website or the back of your card. Tell them it is authorised push payment fraud and ask them to contact the receiving bank.
2. Report it to Report Fraud, the national fraud and cyber crime reporting service run by the City of London Police, which replaced Action Fraud in England, Wales and Northern Ireland in December 2025. You can report online or by calling 0300 123 2040. In Scotland, contact Police Scotland on 101.
3. Contact your IT provider to secure the mailbox: reset passwords, revoke sessions, remove malicious inbox rules and check for other compromised accounts.
4. Warn the genuine supplier or customer by phone, as their systems may be the ones compromised.
5. Consider whether personal data was exposed. If so, you may need to report a personal data breach to the Information Commissioner's Office within 72 hours.
6. Tell your insurer if you have cyber or crime insurance, and follow their incident process.

Since October 2024, rules introduced by the Payment Systems Regulator require banks to reimburse many victims of authorised push payment fraud up to £85,000. These rules cover consumers, microenterprises and small charities, so a very small business may be protected, but larger businesses generally are not. Prevention matters far more than recovery.

How Cyber Fits can help

Cyber Fits helps businesses in Sunderland and across the North East protect their mailboxes with multi factor authentication, email security, DMARC and properly configured Microsoft 365 alerts, and can help you write a simple payment verification process your team will actually follow. A free IT review is a good way to find out where the gaps are.