Invoice and mandate scams cost UK victims £41.3 million in 2025, with £28 million of those losses falling on business and other non-personal accounts, according to UK Finance. Businesses remain exposed when criminals persuade staff to redirect a genuine supplier payment.
The banking trade body’s 2026 Annual Fraud Report records a 4% fall in total losses from this category and a 13% decline for non-personal accounts. The risk persists despite that improvement.
In an invoice or mandate scam, a criminal intervenes in a legitimate payment, often by claiming that a supplier’s bank details have changed. A familiar company name and an expected bill can conceal a different destination for the money.
Bank checks answer different questions
Strong customer authentication uses separate security factors, such as a password and a registered device, to verify the person making a payment. It helps protect accounts but cannot by itself establish whether that person has been deceived into approving a transfer.
The European Banking Authority and European Central Bank’s December 2025 payment fraud report, covering 2022 to 2024, found that manipulation of the payer accounted for more than half of fraudulent bank-transfer value in its European data. It also found evidence that strong authentication was helping reduce fraud, particularly in card payments.
A separate check addresses the recipient. In the UK, Confirmation of Payee compares the account name entered by a customer with the name attached to the bank details. The Payment Systems Regulator says alerts show a match, close match or no match before money is sent.
That can expose a payment being directed to an unexpected account. A matching name, though, is not a check that goods were ordered, delivered or correctly priced. Those questions still belong in the company’s invoice approval process.
Digital invoices still need business checks
France’s electronic invoicing rollout, which began on 1 September 2026, shows how billing is moving away from ordinary email attachments. As we reported in our coverage of the French reform, covered businesses must receive invoices through approved platforms, with issuance obligations being phased in by company size.
The French tax authority says compliant invoices contain structured information that software can process. That changes how invoice data is exchanged. A subsequent request to alter the supplier’s payment details still requires separate verification.
A diverted payment also removes cash that may be needed for wages, stock or other bills. Our earlier explanation of why profitable businesses can run out of cash describes how payment timing can strain an otherwise viable company.
Verify changes outside the email chain
The National Crime Agency and NatWest’s January 2026 invoice-fraud campaign advises finance teams to call the genuine supplier on a previously used number before transferring money when details have changed. Replying to the same email chain may leave the check inside a conversation controlled by criminals.
Their accompanying guidance recommends comparing new invoices with genuine earlier examples and involving another colleague in authorising high-value payments. Our coverage of why financial knowledge alone does not prevent scams examines how pressure and apparent authority can override a person’s usual checks.
If money has already been sent, the agency advises contacting the bank immediately and retaining invoices, emails and other communications for investigators. UK Finance reports that 48% of invoice and mandate scam losses were returned to victims in 2025, across personal and non-personal accounts combined.
