Transaction risk intelligence
Automated supplier statement reconciliation
Supplier risk intelligence
Managed AP recovery audit
Supplier file performance review
Forensic risk analysis
Consulting and bespoke reporting
TL;DR - Invoice Fraud Prevention in 4 Steps
Invoice fraud happens when criminals trick your accounts payable team into paying fake or altered invoices, usually by impersonating a real supplier or intercepting genuine invoices and changing the bank details.
UK businesses lost £49 million to invoice and mandate fraud in 2024, with 78% of those losses hitting business accounts rather than personal ones (UK Finance, 2025).
To prevent invoice fraud in your organisation:
- Cleanse and maintain your supplier master file – remove duplicates and dormant vendors monthly.
- Monitor every transaction for red flags – rounded values, duplicate invoices, unusual timing, inconsistent POs.
- Treat urgent payment requests as suspicious by default – verify via a known phone number, never via reply-to-email.
- Train staff continuously in fraud prevention and whistleblowing – one-off training does not work.
The organisations that eliminate invoice fraud combine all four with AI-powered risk analysis that checks every invoice before the payment run.
What is invoice fraud?
Invoice fraud is a type of payment fraud where scammers manipulate an organisation’s accounts payable process into paying a fabricated invoice or a genuine invoice with altered payment details. The fraud sits inside a broader category the UK Finance Annual Fraud Report classifies as invoice and mandate fraud, and is closely related to Business Email Compromise (BEC) and Authorised Push Payment (APP) fraud.
There are three common patterns:
- Fake invoice fraud – a scammer sends an invoice from a supplier you’ve never dealt with, often mimicking a real vendor’s branding.
- Mandate fraud (invoice redirection) – a criminal impersonates a genuine supplier and requests a change to bank details, diverting legitimate payments.
- Invoice interception – fraudsters hack or spoof a supplier’s email account and change payment details on a real, expected invoice before it reaches your AP team.
All three rely on a moment of inattention inside a high-volume, high-pressure finance function.
How big is the invoice fraud problem in 2026?
Invoice fraud is one of the most common and most expensive fraud types affecting UK businesses. The latest industry data shows:
- £49 million was lost to invoice and mandate scams across 2024, with £25 million lost in H1 2024 alone (UK Finance, Half-Year and Annual Fraud Reports).
- 78% of invoice and mandate scam losses in H1 2024 hit non-personal or business accounts (UK Finance, 2024).
- 11% of UK businesses with employees experienced fake invoice fraud in the 12 months to 2024 – the single most common business fraud type (Home Office Economic Crime Survey 2024).
- 7% of UK businesses also experienced mandate fraud in the same period (Home Office, 2024).
- £1.17 billion was stolen through payment fraud across the UK in 2024, with 3.31 million confirmed fraud cases, a 12% increase year-on-year (UK Finance Annual Fraud Report 2025).
- £629.3 million was stolen in H1 2025 alone – a 3% increase on the same period in 2024 (UK Finance Half-Year Fraud Report 2025).
Invoice fraud is also getting harder to spot. The UK Finance 2025 report specifically flags AI voice cloning, deepfake video calls, and generative-AI-written emails as accelerants making impersonation scams far more convincing than in previous years.
There is also a regulatory dimension. Under the Economic Crime and Corporate Transparency Act 2023 (ECCTA), the “failure to prevent fraud” offence came into force on 1 September 2025, making large organisations criminally liable if they fail to have reasonable fraud prevention procedures in place. Invoice fraud prevention is now a legal expectation, not just a finance best practice.
The 4 invoice fraud prevention tips your AP team needs
1. Cleanse your supplier master file – monthly or quarterly, not annually
A messy supplier master file is the single biggest enabler of invoice fraud. Duplicate vendors, dormant suppliers and unchecked bank-detail changes are where fraudsters hide.
What good looks like:
- Remove duplicate vendor records and suppliers that have submitted no or few invoices in the last 18 months.
- Require two-person confirmation before any change to supplier bank details is approved.
- Run automated checks against sanctions lists, credit data and directors’ registers at onboarding.
- Flag suppliers whose bank details match an employee’s – a classic internal fraud signal.
Treat every request to change credentials as a potential fraud attempt until verified. Change in bank details is the single most common cause of business invoice fraud.
2. Monitor every transaction for fraud red flags
Basic controls like three-way matching are necessary but no longer sufficient. Fraudsters understand approval thresholds and deliberately submit invoices just below them.
Red flags that warrant immediate investigation:
- Invoices with rounded values (£5,000, £10,000) where the supplier normally submits itemised amounts
- Duplicate invoice numbers, or the same value from the same supplier within days
- Invoices submitted at unusual times (e.g. 3am, weekends, public holidays)
- Invoices that fall just below an approval threshold (e.g. £1,995 when the threshold is £2,000)
- Inconsistent POs – invoices received without a matching purchase order
- New suppliers invoicing for large amounts within weeks of onboarding
Manual checking at this level is not realistic for most AP teams. Purpose-built risk analysis software runs these forensic tests continuously against your ERP or ledger and surfaces only the transactions that need a human eye.
3. Treat urgent payment requests as suspicious by default
Urgency is the most common tactic in every major fraud playbook, from BEC to CEO impersonation. If an email asks for a fast or confidential payment, slow down.
The verification rules:
- Never accept a change to payment details via email alone – even from a trusted sender address.
- Always call back on a phone number taken from your existing supplier records, not the one on the invoice or in the email signature.
- Build pause points into the payment workflow for any high-value or high-urgency invoice.
- Require secondary approval for any payment over a defined threshold or to a newly changed bank account.
- Escalate any concern – stopping a legitimate payment for 24 hours costs nothing; paying a fraudulent one costs six figures.
This is the single cheapest and most effective control your business can implement today.
4. Train continuously, and make whistleblowing easy
One-off fraud awareness training does not work. Fraud tactics shift every quarter, and the 2025 wave of AI-generated phishing has made previous training content partially obsolete.
A modern invoice fraud training programme includes:
- Quarterly sessions covering current fraud tactics, including AI voice cloning and deepfake impersonation
- Role-specific scenarios for AP clerks, approvers, procurement and executives – not generic cyber content
- Simulation exercises using realistic fake vendor requests and altered invoices
- Whistleblowing training so employees know exactly how to report a concern without fear
- An anti-fraud culture where raising a flag is rewarded, not treated as an inconvenience
Under ECCTA, proving you have “reasonable procedures” almost certainly requires documented, regular, recorded training.
Quick-reference: Invoice fraud red flags vs. controls
Red flag | Control |
|---|---|
Bank detail change request | Two-person verification + callback on a known number |
Duplicate invoice | Automated duplicate detection before payment run |
New supplier, first invoice high-value | Enhanced onboarding checks + secondary approval |
Invoice just under approval threshold | Threshold monitoring + pattern alerts |
Urgent payment request from executive | Out-of-band verification, never reply to email |
Rounded or unusual invoice value | AI-based anomaly detection on transaction patterns |
Supplier bank details match an employee | Automated cross-check of employee and supplier data |
How FISCAL Technologies prevents invoice fraud
FISCAL’s AI-powered platform sits between your ERP and your payment run, running forensic-level checks on every invoice and every supplier – before money leaves your organisation.
We help AP teams:
- Cleanse and monitor the master supplier file continuously, flagging duplicates, dormant vendors and risky bank-detail changes.
- Detect duplicate payments, overpayments and invoice anomalies in real time, typically recovering the software’s cost in weeks.
- Apply AI pattern recognition across your historical data to spot the unusual – suppliers invoicing at unusual times, values drifting upward, matches between employee and supplier accounts.
- Surface only the transactions that need review, so your team spends minutes, not hours, on fraud control.
Protecting UK and US organisations since 2003, FISCAL supports 40+ healthcare organisations, local government bodies across the UK, and over 100 private-sector businesses.
Frequently asked questions about invoice fraud
What is the most common type of invoice fraud?
The most common type of invoice fraud in the UK is mandate fraud, where criminals impersonate a genuine supplier and request a change to bank details so future payments are diverted to the fraudster’s account. The Home Office Economic Crime Survey 2024 found fake invoice fraud affected 11% of UK businesses and mandate fraud affected 7%.
How much money is lost to invoice fraud each year?
UK businesses lost £49 million to invoice and mandate fraud in 2024, with £25 million lost in H1 2024 alone. Total UK payment fraud across all types reached £1.17 billion in 2024, rising to £629.3 million in just the first half of 2025 (UK Finance, 2025).
Is invoice fraud a cybercrime?
Yes. Invoice fraud is generally classified as a form of Business Email Compromise (BEC) and sits under the broader cybercrime umbrella. It typically involves phishing, email spoofing or compromised supplier accounts – even when no malware is involved.
How can I spot a fake invoice?
Key fake invoice red flags include: unexpected bank detail changes, unusual urgency, rounded or unusually high values, invoices just below your approval threshold, duplicate invoice numbers, invoices without a matching purchase order, and formatting inconsistencies or generic templates that don’t match the supplier’s usual style.
What should I do if I think I've been a victim of invoice fraud?
If you suspect invoice fraud: (1) stop the payment immediately if it hasn’t left the account, (2) contact your bank to attempt recall if it has, (3) report to Action Fraud on 0300 123 2040 or via actionfraud.police.uk, (4) notify the genuine supplier, (5) preserve all evidence, and (6) review how the fraud got through to strengthen controls.
Does the UK's "failure to prevent fraud" law apply to my business?
The ECCTA 2023 “failure to prevent fraud” offence came into force on 1 September 2025. It applies to “large organisations” meeting at least two of: 250+ employees, £36m+ turnover, or £18m+ total assets. If your business qualifies, you are legally required to have reasonable fraud prevention procedures – including invoice fraud controls – or face unlimited fines.
How does AI help prevent invoice fraud?
AI helps prevent invoice fraud by analysing patterns across millions of transactions to detect anomalies humans would miss – unusual supplier behaviour, subtle duplicate patterns, bank detail changes that correlate with fraud signatures, and timing anomalies. AI-based tools like FISCAL’s platform run continuously against your ERP, catching risks before the payment run rather than after.
What's the difference between invoice fraud and mandate fraud?
Invoice fraud is the umbrella term for any fraud committed using invoices – fake, altered or duplicated. Mandate fraud is a specific subtype where the criminal changes payment mandate details (usually bank account) so legitimate invoices are paid to the wrong account. Mandate fraud is technically a form of invoice fraud.
Sources
- UK Finance, Annual Fraud Report 2025 (published May 2025)
- UK Finance, Half-Year Fraud Report 2025 (published October 2025)
- Home Office, Economic Crime Survey 2024
- Office for National Statistics, Fraud and computer misuse in England and Wales, year ending March 2025
- Economic Crime and Corporate Transparency Act 2023 (ECCTA)
Last updated: September 2026
