Paying an invoice? Check the bank details first

Invoice fraud is simple and brutal. You get a genuine-looking invoice, or a polite note saying "our bank details have changed". You pay. The money goes to a criminal, and the real builder, solicitor, supplier or landlord is still waiting to be paid. Here's how it works and the one habit that stops it.

How the scam works

1. They get into the email chain

   Criminals break into the email account of a business, a tradesperson, a solicitor or sometimes you. Weak or reused passwords and phishing emails are the usual way in. They then sit and read quietly, sometimes for months, waiting for a payment to be due.

2. They change the details

   At the right moment they either edit the real invoice before you see it, or send a follow-up saying "please note our new bank account" or "our usual account is being audited, use this one". Everything else looks right: the logo, the job, the amount, the names, the email signature. Sometimes the message comes from a lookalike address with one letter changed.

3. You pay the wrong account

   The money lands in an account the criminal controls, often a "money mule" account, and is moved on within minutes.

4. The real invoice is still unpaid

   The genuine supplier chases you weeks later. By then the money is usually gone. Businesses are hit hardest because they make large payments routinely, but homebuyers, tenants paying deposits and people paying builders lose money this way every day.

UK Finance counted 2,305 invoice and mandate scams in 2025 with £41.3 million lost, an average of nearly £18,000 per case. Around two-thirds of the money came from business accounts, and only about half was ever recovered.

Warning signs

• Any change of bank details, however it's explained. "New account", "audit", "switching banks", "pay our parent company", "the usual account is frozen".
• Urgency. "Pay today to keep your completion date", "we'll have to stop work", "discount if paid in the next hour".
• A request to pay a different name. Your bank's Confirmation of Payee check says "no match" or shows a person's name when you expected a company. See what the name check means.
• A slightly different email address. Compare it letter by letter with earlier emails: smithbuilders.co.uk and smith-builders.co.uk are not the same.
• Being asked not to phone, or being given a new "direct" number to call instead of the one you already have.
• An invoice you weren't expecting, or a duplicate of one you've already paid.

How to pay safely

• Verify by phone, every time details are new or changed. Use a number from a previous invoice, the company's own website or a letter. Never the number in the email you're checking: the criminal wrote that email and will happily answer that phone.
• Don't reply in the same email thread to ask "is this genuine?" If the account is compromised, the criminal answers "yes".
• Agree the bank details at the start of any big job or purchase, in person or on the phone, and write them down. Treat any later change as suspicious until confirmed.
• Send a small test payment first for large amounts, such as £1, and confirm by phone that it arrived before sending the rest.
• Read the Confirmation of Payee result when you set up the payee. A "no match" means stop and phone.
• Check an IBAN or sort code before you pay. Our IBAN checker and sort code lookup show which bank and country an account belongs to. A UK plumber whose "new" IBAN is at a bank in another country is a red flag.
• Protect your own email. Use a strong, unique password and two-step verification. If criminals get into your inbox they can see every invoice you're sent.

If you send invoices

You can make it much harder for criminals to alter your invoices and to use your name against your customers.

• Send invoices as a PDF, not an editable document. Flatten or lock the PDF so the text can't be changed, or send a picture of the invoice. A Word or Excel file can be edited in seconds.
• Put your bank details on every invoice, in the same place, and add a line such as: "Our bank details will never change by email. If you receive a message saying they have, phone us on the number on our website before paying."
• Tell new customers your bank details by phone or in person at the start, so they have something to compare with.
• Turn on two-step verification on your email account and check for forwarding rules you didn't set up. Criminals often add a rule that silently copies your emails to themselves.
• Register lookalike versions of your domain name if you can, and use a professional email address rather than a free one that anyone could imitate.
• Make a second person approve any change to supplier bank details if you run a business, and confirm the change by phone with the supplier first.

If you've paid the wrong account

Last reviewed: October 2026