🧾 Invoice Fraud and CEO Scams UK — The Business Guide

Sunday, 02 August 2026

Invoice fraud and CEO fraud (also called Business Email Compromise, or BEC) are among the most costly scams for UK businesses. Criminals trick finance staff into paying fake invoices or transferring money to "the boss" — often losing companies tens of thousands of pounds in a single payment.

This guide explains how these scams work and the simple checks that stop them.

The two main scams

1. Invoice fraud

Criminals either:

  • Fake an invoice — a convincing bill from a supplier you use, but with their bank details swapped in
  • Hack a supplier's email — and send a "we've changed bank accounts, please pay the new one" message
  • Intercept a real invoice — and change the payment details before you pay

The payment goes to the criminal's account. The real supplier never gets paid — and you may not notice until they chase you.

2. CEO / mandate fraud

A message that looks like it's from your CEO, director, or manager:

  • "I need you to make an urgent transfer to this account for a confidential deal"
  • "Can you pay this invoice today? I'm in a meeting and can't talk"
  • "Update my bank details in the payroll system"
  • Often sent late on a Friday, or during holidays when the real boss is unreachable

Finance staff, under pressure, transfer the money — and the "CEO" was a fraudster (often a hacked email account or a lookalike domain like [email protected] vs [email protected]).

The red flags

  • ⚠️ A change of bank details — especially by email, without a phone call to confirm
  • ⚠️ Urgency and secrecy — "confidential", "do it now", "don't discuss with anyone"
  • ⚠️ Unusual payment amounts or recipients — new supplier, new account, large sum
  • ⚠️ Emails from slightly wrong domains — company.c0.uk, company-ltd.com, extra letters
  • ⚠️ Late Friday / holiday timing — when the real decision-maker is unreachable
  • ⚠️ Invoice number you can't match — no PO number, no purchase order
  • ⚠️ Pressure on a junior staff member — fraudsters target the newest finance staff

⚠️ The golden rule: any change to payment details or any urgent transfer must be verified by a second channel — call the supplier/boss on a number you already have (not the one in the email), or confirm in person.

How to protect your business

Payment controls

  1. ✅ Verify bank details by phone — call the supplier on their known number before paying a changed account
  2. ✅ Two-person approval for payments over a set amount
  3. ✅ Match invoices to purchase orders — no PO, no payment
  4. ✅ Call the invoice sender to confirm before paying new suppliers

Email security

  1. ✅ Set up DMARC/SPF/DKIM — blocks domain spoofing
  2. ✅ Watch for lookalike domains — regularly check for domains similar to yours
  3. ✅ Enable 2FA on all email — hacked email is how most BEC starts
  4. ✅ Train staff — regular phishing awareness, especially finance teams

Process rules

  1. ✅ "Never change bank details on email alone" — make it a written policy
  2. ✅ Agree a verification code word for urgent internal requests
  3. ✅ Route all payment changes through one person — no exceptions
  4. ✅ Report and review every suspicious email internally

What to do if your business is hit

Speed is critical — every hour matters:

  1. Call your bank's fraud team immediately — ask them to recall/reverse the payment (Faster Payments can sometimes be intercepted)
  2. Report to Action Fraud — 0300 123 2040 or actionfraud.police.uk — within hours, not days
  3. Get a crime reference number — see our guide
  4. Report to the receiving bank if known — some banks freeze suspicious incoming funds
  5. Notify your insurer — cyber and crime policies may cover the loss
  6. Secure your email — reset passwords, check for forwarding rules, remove compromised accounts
  7. Warn the real supplier — they may be victims too (hacked account)

The numbers that matter

  • Invoice/CEO fraud is one of the top reported business scams in the UK
  • Losses per incident commonly run £5,000–£100,000+
  • Most losses are never recovered — prevention is everything
  • The scams succeed because payment processes rely on trust, not verification

Related guides

CyberAware UK — helping families report crime, recover from scams, and stay safe online.