How to spot, stop and protect your small business from payment fraud

Recognise the payment instruction that deserves a pause

Invoice fraud often changes just one thing: the receiving bank account. Criminals may imitate a supplier, compromise a genuine mailbox or pretend to be a director authorising a confidential transfer. A correct invoice number, familiar writing style or convincing voice is not independent confirmation.

Watch for new bank details immediately before a payment, unusual secrecy, pressure to act outside normal hours and requests to split a large transfer into smaller ones. A Confirmation of Payee warning should prompt investigation, not an automatic override. Even a matching name does not establish that the underlying instruction is genuine.

Treat supplier-record changes as a separate decision

A payment can pass every approval threshold and still go to the wrong place if the supplier record has already been altered. Separate permission to amend bank details from permission to pay an invoice. Keep a record of the previous details, the request, the independent verification and the person approving the change. Decide how exceptions are handled when the usual contact is unavailable, rather than inventing a shortcut during a deadline.

The callback should confirm the change itself, not reveal confidential account information to an unknown caller. If the supplier says it did not request a change, stop and investigate related invoices too. Consider whether staff have received the same message elsewhere and whether a genuine mailbox is compromised. A documented record lets the business explain its actions without relying on someone remembering a telephone conversation weeks later.

Check unusual refund and overpayment requests

Fraud controls should cover money going back to customers as well as supplier payments. An apparent overpayment followed by a request to refund a different account deserves scrutiny. Independently establish whether the original payment is genuine, settled and attributable to the customer, using your bank or payment provider where needed. Do not rely on a screenshot or a forwarded receipt as proof that usable funds have arrived.

Set an approved refund route and require escalation when the destination or amount differs from the original transaction. Staff should not be criticised for pausing a suspicious instruction. Keep customer-service messages neutral while checking; a legitimate customer may also be confused. The aim is a consistent verification process, not an assumption that every unusual request is criminal or that a card payment can never later be disputed.

Rehearse the decision with a realistic example

Try a fictional message from the owner requesting an urgent £8,500 transfer while supposedly in a meeting. Ask the team which independent contact route it would use and who could approve the payment. If the answer is simply to reply to the message, the exercise has exposed a gap. Test the same process when the owner is travelling and the usual finance colleague is absent.

Record the response you want: pause, verify, escalate and document. Do not use training to blame the employee who notices a problem late; that can discourage reporting. Review whether approval thresholds, account permissions and trusted contact records support the intended behaviour. Training is most useful when the operating process makes the safe action practical, including for a very small team with no dedicated finance department.

Keep a response record without assuming reimbursement

Create an incident log with the payment reference, amount, receiving details, discovery time and contact with the bank. Preserve the original messages and any evidence requested by investigators. Record what access was disabled and which genuine suppliers or customers were contacted. Share sensitive information only through an appropriate secure route rather than circulating the entire incident by email.

Financial recovery and technical recovery are different tasks. Even if a payment is recalled, a compromised account may still expose the next instruction. Conversely, securing the account does not establish that money will be returned. Update the cash forecast using confirmed available funds and seek advice about immediate obligations. Review the cause after urgent containment, then change the process that failed rather than relying solely on a reminder to be careful.

Create a two-person verification process

Keep a supplier master record containing bank details and a trusted contact number established before any change request. When details change, call that number and document who confirmed the change. Do not use a contact number supplied in the suspicious message, its attachment or a newly shared website.

For example, if a £12,000 stock invoice moves to a new account, one colleague can verify the change while another releases the payment. A small test transfer only proves that an account receives money; it does not prove the account belongs to your supplier. Sole traders can use an independent callback and a deliberate cooling-off check.

What to do immediately after a suspected fraudulent payment

Contact your bank through its official app, website or an independently verified telephone number. Explain that the payment may be fraudulent and ask about recall, investigation and any applicable reimbursement process. Recovery is not guaranteed and rules depend on the payment, customer and circumstances.

Follow NCSC guidance: alert your IT contact, preserve messages and transaction details, and secure any compromised account. Change credentials from a trusted device, review email forwarding rules and revoke suspicious sessions. Use the official reporting route linked by the NCSC; avoid anyone demanding an upfront recovery fee.

Make fraud prevention part of cash-flow management

Use multi-factor authentication, individual accounts, approval limits and regular staff practice. Record who can create a supplier, amend its bank details and authorise a transfer. Review these permissions when people change roles or leave.

If a loss threatens payroll or loan repayments, contact affected creditors early and prepare a short cash-flow forecast. Consider funding only after understanding the loss, the repayment source and the security fix. Do not move money or take borrowing instructions from the suspected fraudster.

• Review all supplier changes each week.
• Give staff permission to stop a suspicious payment without blame.
• Test the response plan using a fictional invoice, never a real transfer.