In short
- ✓Payment diversion fraud uses convincing emails to change where you, or your customers, send money.
- ✓Always confirm new or changed bank details by phone, using a number you already have.
- ✓Protect email with MFA so criminals can't take over your account.
- ✓Set up SPF, DKIM and DMARC so criminals can't send email pretending to be your domain.
How the fraud works
Criminals either take over a real email account, often through phishing, or send email from a look-alike address. They watch genuine conversations, then step in at the right moment with an invoice or a message saying the bank details have changed. Because the timing and tone look right, payments are made to the criminal's account.
Phishing was the most common attack on UK businesses in the government's latest Cyber Security Breaches Survey, affecting 38% of all businesses.
Warning signs
- A request to change bank details, especially with urgency or pressure.
- A slightly different email address or domain, such as an extra letter or a different ending.
- Changes in tone, spelling or signature from someone you deal with regularly.
- Requests to keep the change quiet or to pay before a deadline.
Five checks that stop it
- Agree a call-back rule: never change bank details without phoning a known contact on a number you already have, not one in the email.
- Turn on multi-factor authentication for every email account.
- Check for unexpected mailbox forwarding rules, a common sign of a hidden takeover.
- Set up SPF, DKIM and DMARC on your domain, then move DMARC to enforcement so impostors are blocked.
- Tell customers how you'll never change your bank details, so they can spot fakes too.
If you've already paid
Call your bank immediately and ask them to contact the receiving bank. Then report it to Report Fraud (reportfraud.police.uk, 0300 123 2040), which replaced Action Fraud, and get the affected email account checked for compromise.
Questions
Will my bank refund a fraudulent business payment?
It depends. Under the UK's authorised push payment (APP) scam reimbursement rules, micro-enterprises and small charities can be covered in the same way as consumers, but larger businesses usually aren't. Either way, call your bank immediately to give the best chance of recovering the money.
What is DMARC and does it stop invoice fraud?
DMARC tells receiving email servers to reject messages pretending to come from your domain. It stops criminals spoofing your exact address, but not look-alike domains, so a call-back rule is still essential.