An email arrives from a supplier you've used for years. Same name, same signature, same friendly tone. They've switched banks, and could you pay this month's invoice into the new account? Nothing about it looks odd. That's exactly why this scam works, and new police figures show how much it's costing UK businesses.
The numbers
On 28 September 2026, City of London Police and Report Fraud issued a warning about payment diversion fraud. In the 2025/26 financial year, Report Fraud received 3,657 reports of payment diversion fraud, up 3% on the year before, and victims reported losing more than £101 million.
Invoice fraud was the most common type, with 813 reports (22% of the total). Around 35% of reports came from organisations rather than individuals, and among businesses that gave their sector, construction recorded the most reports. The police say smaller organisations are especially exposed because they have fewer resources for cyber security and for checking payments.
The banks see the same pattern. UK Finance's Annual Fraud Report 2026 recorded 2,305 invoice and mandate scam cases in 2025, with £41.3 million lost. Only 48% of those losses were returned to victims. The two sets of figures count different things (reports to the police versus cases recorded by banks), so they don't line up exactly. Both show the problem holding steady rather than surging: Report Fraud says overall reported losses have fallen, and UK Finance recorded small drops in invoice scam cases and losses. Steady, though, still means millions lost.
How the scam works
Payment diversion fraud is simple at heart: trick someone into sending money to an account the criminal controls instead of the right one. According to the police, criminals usually get there in one of two ways.
A real email account, taken over
Criminals get into a genuine mailbox, either yours or your supplier's, often using a stolen password. They read old invoices, learn who pays whom, and wait. When the change of bank details arrives, it really does come from the supplier's own address, so it passes every "does this look right?" check.
A convincing copy
Other times there's no hacking at all, just an impersonation email from a lookalike address or an edited invoice with new bank details. A busy person paying bills between other jobs can easily miss it.
AI is making it smoother
The police warn that criminals are increasingly using AI to write convincing phishing emails, mimic someone's writing style and even impersonate voices and video calls. The old giveaways, like clumsy spelling or an odd tone, are disappearing.
What this means for UK small businesses
Large companies often have finance teams, approval rules and someone whose job is to question odd requests. In a small firm, the person paying invoices may also be answering the phone, chasing orders and doing payroll. Criminals know that.
Two points matter most. First, your supplier's weak security can quickly become your loss: if their mailbox is compromised, the fake request comes from a sender you trust. Second, the money doesn't always come back. Once a payment has gone, recovery depends on how quickly you act and on your bank, and in UK Finance's figures fewer than half of invoice scam losses were returned.
The good news is that the strongest defence is cheap, quick and needs no special technology.
What to do this week
Call before you change any bank details. Phone the supplier on a number you already hold, not one in the email or invoice. The police put this first for a reason.
Test large payments. For big sums, the police suggest sending a small test payment first and confirming the supplier received it.
Limit who can change payee details. Only named people should be able to amend payment arrangements, and a second person should check any change.
Lock down your email. Turn on multi-factor authentication for every mailbox, especially finance and directors' accounts, so a stolen password alone isn't enough to get in.
Know what to do if it happens. Contact your bank immediately, then report it to Report Fraud on 0300 123 2040. Be wary of anyone who later calls offering to recover your money, as the police warn this is often a second scam.
Sophia Says
"What strikes me about payment diversion fraud is that nothing looks broken. There's no virus warning and no locked screen, just a polite email and a payment that quietly goes to the wrong place. The fix isn't fancy technology, it's a two-minute phone call. I'd love every small business to make 'we always call to check' a rule that nobody feels awkward about following."
"Where HackRisk helps is everything that happens before that email arrives. Most of these scams need a way in, such as a mailbox opened with a leaked password or a supplier with weak security. I check whether your team's logins are already circulating on the dark web, map what your business exposes online, keep an eye on the security of the suppliers you pay, and run realistic phishing tests so your team spots the 'new bank details' email before any money moves."
— Sophia, HackRisk AI Security Analyst
Where HackRisk fits
Mailboxes opened with leaked passwords: a Dark Web Scan tells you if staff email credentials are already out there, so you can change them before criminals use them.
Staff fooled by convincing emails: Phishing Simulations let your team practise spotting fake payment requests safely, and Security Awareness Training makes "call to check" a habit.
A supplier's email being compromised: Supply Chain Risk shows how well the firms you pay are protecting themselves.
What criminals can learn about you: our Recon Scan maps what your business exposes on the internet, from forgotten systems to the details attackers use to plan a convincing scam.
Get your free HackRisk report
See your business the way a criminal does. Get your free HackRisk report and find out where a fake invoice scam could get its foothold.