The invoice looked right — but the bank details had been swapped

A bill from a tradesperson you know, for work you can see has been completed, can feel routine to pay. That is exactly why invoice interception fraud can work. The invoice may look genuine, but the bank details on it may belong to a criminal.

The practical rule is simple: never accept new or changed bank details from an email alone. Before transferring money, call the business using a telephone number you have used before or found independently on its official website. That short check can stop a payment going to the wrong account.

How a genuine invoice can be used to scam you

This type of scam is often described as invoice redirection fraud or payment diversion fraud. It does not necessarily start with an obvious fake email full of mistakes.

A criminal may gain access to a contractor’s email account, or imitate it closely. They may then see messages about planned work, deposits or final payments. At the right moment, they send an invoice or reply to an existing email chain with one key change: the bank details.

The rest can look familiar:

• your correct name and address;
• the agreed work and price;
• a recognisable invoice layout or logo;
• the name of the person you usually deal with;
• an email chain containing genuine earlier messages.

That is what makes this different from a random phishing email. It relies on an existing relationship and the understandable wish to pay a bill promptly.

A familiar invoice number, wording and total do not prove that the bank details are genuine.

Why the altered detail is easy to miss

Most people check the main parts of an invoice: who it is from, what the work involved and whether the total is right. Bank details often appear at the bottom of a PDF or in a short line within an email, so they can seem like routine information.

A message may say that the business has changed banks, has a new accounts department or needs payment sent elsewhere because of an administrative problem. It can sound believable, particularly during a busy house move, renovation or before a bank holiday.

Pause and check if:

• the payee details differ from an earlier invoice;
• an email says the bank account has “just changed”;
• you are asked to act urgently or keep the change confidential;
• payment instructions appear only in the email, rather than in the usual invoice format;
• a larger-than-usual deposit is requested;
• the sender’s address has a small difference, such as an extra character or altered domain;
• the account name does not match the trader or company you expected.

No single sign proves fraud. But a changed bank account should always trigger an independent check.

Check payment details safely before you transfer

Treat any change in bank details as something to verify, whether you are paying a roofer, builder, solicitor, nursery, supplier or managing agent.

1. Find a contact route yourself

Use a number from an earlier invoice, business card, saved contact, signed quote or the firm’s official website. Do not use a number in the email announcing the new details: it could connect you to the fraudster.

If you found the business through a trade platform, use its verified contact method where available. Companies House can help you check limited-company details, but it does not verify bank accounts.

2. Confirm the details by phone

Call the business and say that you are about to make payment. Ask it to confirm the sort code and account number, or ask it to confirm the details you already hold.

Do not rely on an email reply. If the business mailbox has been compromised, a criminal may be able to answer as though they are the supplier.

For repeat suppliers, keep a dated record of verified payment details in a secure place. If details later change, verify them again.

3. Take notice of Confirmation of Payee

Many UK banks and building societies use Confirmation of Payee when you set up a transfer. It may show that the account name is a match, close match or no match to the name you entered.

This is useful protection, but it is not a replacement for calling the supplier. If you receive a close match or no match, stop and investigate. Do not alter the payee name simply to make the warning disappear unless you have independently confirmed the reason.

4. Treat saved payees with care

A saved payee is not automatically safe forever. If a supplier says its details have changed, check by telephone before changing anything in your banking app.

For a substantial payment, it can help to have another person compare the invoice with the quote and check that a verification call was made.

If you have already sent the money

Act immediately. The sooner your bank is told, the more chance it may have to try to trace or recover the funds before they are moved on.

1. Contact your bank straight away. Use the number on the back of your card, its official app or its official website. Explain that you believe you have made a payment as a result of invoice fraud and ask what it can do to recall or trace the transfer.
2. Tell the genuine trader or business. It may need to secure its email account, warn other customers and confirm its real payment details.
3. Report the fraud. In England, Wales and Northern Ireland, use Report Fraud, the national reporting service for fraud and cyber crime. In Scotland, report fraud to Police Scotland on 101. Call 999 only if there is an immediate danger or crime in progress.
4. Keep the evidence. Save the invoice, emails, payment confirmation, account details used and notes of any calls. Keep email headers too, if you know how to access them.
5. Watch for a follow-up scam. Fraudsters may pose as a bank, recovery company or police officer and offer to retrieve money for an upfront fee. Do not pay someone to “release” or recover your funds.

If you are worried that a call, text or email claiming to be from your bank is fraudulent, you can call 159 to reach participating banks safely. Check whether your bank participates before relying on the service.

Your bank will assess what happened and explain its process. Recovery is not guaranteed, which is why reporting the payment quickly matters.

What tradespeople and small firms can do

Customers should not carry all the responsibility. Small firms can reduce the risk and make clients feel safer by setting clear payment procedures.

Useful steps include:

• turning on multi-factor authentication for email accounts;
• using strong, unique passwords, ideally held in a reputable password manager;
• checking mailbox rules and forwarding settings for unfamiliar automatic forwarding;
• keeping software and devices up to date;
• telling customers at quotation stage that bank details will not be changed by email alone;
• including a trusted telephone number on invoices for payment checks;
• giving staff a clear process for reports of changed payment details.

If you think an email account has been accessed, change its password from a safe device, sign out of other sessions where possible and review forwarding rules. Contact the email provider, then warn current customers through a trusted channel.

A legitimate business should welcome a quick call to verify payment details.

Common mistakes that make invoice fraud easier

The problem is rarely carelessness. It is more often being rushed by what appears to be an ordinary household task. A few habits, however, can give fraudsters an advantage.

Paying on a phone while distracted

A small screen makes it harder to compare sender addresses, account names and documents. For an important transfer, view the invoice on a larger screen and compare it with the original quote.

Trusting an existing email thread

A reply in a genuine conversation can feel convincing. But someone with access to a mailbox may be able to continue a thread or copy the usual writing style. Confirm changed details outside email.

Calling the number in the suspicious message

If a criminal controls the email, they can provide a false number and answer the call convincingly. Find the contact details yourself.

Letting urgency replace checks

“Pay today to avoid delay” is designed to make you act before thinking. A genuine firm should understand a brief verification call, especially if its bank details have changed.

Sending a test payment

A £1 test payment only shows that an account can receive money. It does not show that the account belongs to your supplier.

Make a safer payment routine at home

You do not need specialist cyber knowledge to make this fraud much harder. Create a routine for transfers that are larger than your everyday payments.

Keep quotes, invoices and verified contact numbers together securely. Compare the final invoice with the original estimate. If the account details are new, call. If you feel pressured, wait until you can check properly.

For projects with staged payments, agree at the start how bank details will be confirmed and whether they should remain unchanged. Never share online-banking passwords, security codes or one-time passcodes with an unexpected caller, text sender or emailer. Your bank will not ask you to move money to a so-called safe account.

The aim is not to distrust every local trader or supplier. It is to separate a genuine bill from the instructions for paying it. The work may be real and the invoice may be fair, but one altered line can still send your money elsewhere.