Guide

Fake invoice and bank-detail change emails: what to check before you pay

How fake invoice and changed-bank-details emails work, the warning signs, what to check before you pay a supplier, and what to do if you already paid.

Published · Sources checked · 4 min read

A fake invoice email asks you to pay a real supplier's bill into a new account. It often comes from a lookalike address or from inside a genuine email thread. Before you pay any new bank details, call the supplier on a number you already had, not one in the email, and confirm the account.

How invoice and bank-detail change scams work

UK Finance, the banking industry body, describes the scam simply. You try to pay a genuine invoice, and a criminal redirects the payment. The criminal poses as a supplier, a builder or a solicitor and says the bank details have changed. It often involves intercepted emails or a compromised email account. The UK's Report Fraud service calls the same crime mandate fraud or payment diversion fraud. In the US it falls under business email compromise.

How common invoice fraud is

  • UK: UK Finance counted 2,305 cases and £41.3 million in losses in 2025. Business accounts carried 68% of the losses, and 48% was returned to victims.
  • UK, one month: the National Crime Agency reported £3,908,086 lost across 83 reported cases in September 2025, more than £47,000 per case.
  • Australia: the National Anti-Scam Centre put payment redirection losses at A$166.8 million in 2025, the second-largest scam type by loss.
  • US: the FBI recorded $3,046,598,558 in business email compromise losses in 2025. The business email compromise examples guide walks through thirteen cases.

Warning signs in a fake invoice email

The National Crime Agency's invoice fraud sheet lists urgency, a message about changed bank details, an invoice that does not match earlier ones, and small changes to the sender's address. Australia's Scamwatch adds that the email can sit inside a genuine thread and copy the supplier's logo and business number. The cases in the archive show each sign:

  • Milwaukee paid $460,866 to scherrerconstruction.us. The builder uses .com.
  • Cottage Grove paid $1,276,061.33 to an address that added "inc" to the contractor's domain.
  • Boulder County's fake vendor said it had been hacked and needed new details.
  • Pine Bluff School District got fake wiring instructions in the same thread as a real invoice, and wired $3,204,639.55.

What to check before you pay

  1. Call the supplier on a number you already had. The National Crime Agency says to use a previously used number. The FBI says to use previously known numbers, not those in the email. The fraudster controls the email, its signature and any number in it.
  2. Send a small test payment first for large sums, and confirm with the supplier that it arrived. Report Fraud advises this.
  3. Have a second person approve high-value payments, as the National Crime Agency recommends.
  4. Limit who can change a supplier's bank details, another point from Report Fraud.
  5. In the UK, read the Confirmation of Payee result. Before a payment goes, your bank checks the name on the receiving account against the name you entered. A close match shows the real name. Pay.UK says the check does not guarantee that fraud is detected, so a match does not replace the call.
  6. Tell your suppliers how you work. The UK's National Cyber Security Centre suggests saying in plain words that your own bank details will never change, so that a message claiming otherwise stands out.

The seven checks for Gmail and Outlook cover the message itself: the sender's real address, the links and the authentication.

  1. Call your bank now and ask it to freeze or recall the payment. The FBI says to ask for a recall straight away. The National Crime Agency says to keep every email.
  2. Report it. In the UK, contact Report Fraud online or on 0300 123 2040. In the US, file at ic3.gov whatever the amount, because the FBI says it can help freeze funds.
  3. Check how it happened. If the instructions came from a real mailbox, yours or the supplier's, the account needs a password reset and a check for forwarding rules.
  4. Beware of recovery offers. Report Fraud warns about recovery scams, in which someone contacts a victim and offers to get the lost money back.

What Antilure draws for a fake invoice

On a message that asks to change payment details, Antilure marks the request, explains the sender and whether the domain imitates one you know, and draws a banner inside the email in Gmail or Outlook with the line "don't reply or pay, check with the sender another way", on your own computer. Download Antilure.

Sources

  1. Annual Fraud Report 2026, UK Finance, June 2026, page 41.
  2. Mandate fraud, Report Fraud, City of London Police, checked 7 November 2026.
  3. NCA and NatWest launch campaign to protect against Invoice Fraud in business, National Crime Agency, 29 January 2026.
  4. Invoice fraud infosheet, National Crime Agency with NatWest, January 2026.
  5. Business email compromise scams, Scamwatch, Australian Competition and Consumer Commission, checked 7 November 2026.
  6. Targeting scams: report of the National Anti-Scam Centre on scams data and activity 2025, ACCC, March 2026.
  7. 2025 IC3 Annual Report, FBI Internet Crime Complaint Center, 6 April 2026.
  8. Business Email Compromise, public service announcement I-082715a-PSA, FBI Internet Crime Complaint Center, 27 August 2015.
  9. Business Email Compromise: The $55 Billion Scam, FBI Internet Crime Complaint Center, 11 September 2024.
  10. Confirmation of Payee: FAQs, Pay.UK, checked 7 November 2026.
  11. Phishing attacks: defending your organisation, National Cyber Security Centre, reviewed 13 February 2024.