Fake invoices and changed bank details: payment scams explained
In a fake invoice scam, also called payment redirection or invoice fraud, a criminal persuades a business to pay a real supplier’s invoice into the wrong bank account, usually by announcing new bank details from a hacked or look-alike email address. The one check that stops it: confirm any change of bank details by phone, on a number you already have.
How fake invoice and payment redirection scams work
The scam targets a payment you were going to make anyway. An email arrives from a supplier you really use, sometimes in a real conversation, saying that its bank details have changed; or an invoice arrives that looks exactly like the usual one, with a new account number. You pay, the supplier never receives the money, and the criminal’s account is emptied within hours. It is the most expensive of the scams aimed at small firms, and Australia’s Scamwatch gives the defense in one line on its business email compromise page: contact the business by phone, using a number you have sourced independently.
How the money gets diverted
UK Finance describes the pattern precisely: the victim tries to pay a legitimate payee, and the criminal intervenes to convince them to redirect the payment, often by intercepting or compromising email. The scammer may have access to the supplier’s mailbox, to yours, or simply register an address that differs by one letter.
Scamwatch publishes the story of an Australian business that lost A$190,000 when a supplier’s email was hacked. The invoices were perfect copies, the sender address was correct, and, in the business’s own words, the change in bank details was the only sign.
What it costs
| Country | Source | Figures |
|---|---|---|
| UK | UK Finance Annual Fraud Report 2026, data for 2025 | Invoice and mandate scams: £41.3 million and 2,305 cases, the lowest on record; 68% of losses (£28.0 million) from business accounts |
| Australia | ACCC, Targeting Scams 2025 | Payment redirection scams: A$166.8 million |
| US | FBI IC3, 2025 Internet Crime Report | Business email compromise, which includes these scams: about $3 billion in reported losses |
The UK figures are falling, but most of the money lost still comes from businesses rather than individuals, and the US totals show how large the problem remains.
The checks that stop it
- Call before you change. Any request to change a supplier’s bank details, or an invoice with new details, gets a phone call to a number you already have on file or find yourself, never one from the email.
- Two people for large or new payments. Scamwatch recommends approval by more than one person above a set amount.
- Never change payment details from an email alone, even one that comes from the right address in an existing conversation.
- In the UK, read the Confirmation of Payee result. British banks check the account name against the details you enter and show a match, a close match, or no match. A mismatch is a reason to stop and call.
- Protect the mailboxes involved. Many of these scams start with a hacked email account, so turn on a second factor for everyone who handles invoices.
- Write the procedure down. A short rule, known by everyone who pays bills, removes the pressure when “the supplier” insists it is urgent.
If you have already paid
Call your bank immediately and ask it to recall the payment. The FBI’s IC3 puts it simply: if you discover a fraudulent transfer, time is of the essence; through its rapid response process with banks, it helped freeze $507 million in US payments in 2025. Then call the real supplier, and report the fraud in your country.
UK: what reimbursement covers
Since October 7, 2024, British payment providers must reimburse victims of authorized push payment fraud for payments made through Faster Payments or CHAPS between UK accounts, according to the Payment Systems Regulator, which is being folded into the Financial Conduct Authority. The protection covers individuals, micro-enterprises (fewer than 10 people and annual turnover or balance sheet of no more than €2 million), and charities with income under £1 million. The limit is £85,000 per claim, the claim must be made within 13 months, and the bank may deduct an excess of up to £100. Larger businesses are not covered and depend on their bank’s own policy.
We did not research equivalent schemes in other countries. In the US, Canada, and Australia, ask your bank what protection applies, and act fast: recovery depends largely on how quickly the bank can stop the transfer.
When the attacker is inside the mailbox
If the request comes from a real, compromised account, the usual email checks will not help. Our page on business email compromise and CEO fraud explains how these intrusions work.
Reporting a payment fraud
The right agency depends on your country. See where to report a fraud in the US, UK, Canada, and Australia.