Invoice Fraud: How to Spot, Prevent and Recover From It

Invoice fraud can be one of the most damaging types of fraud, and UK Finance reported that £41.3 million was lost to invoice fraud in 2025.

Business owners and individuals are regularly targeted by invoice fraud, and it is more important than ever to keep yourself and your business protected.  

It is important never to act on new or changed bank details without verifying them on a known number.  

In this article, we will discuss what invoice fraud is, how to spot it, how to prevent it, and how to recover from it. 

What is Invoice Fraud?

Invoice fraud is when a fraudster tricks you into sending funds to their account through an invoice, rather than the legitimate account you intended to pay.  

Fraudsters look for situations where you're likely to send large sums from your account and try to insert themselves into the process. When successful, they manage to convince you that they are the conveyancer, builder, solicitor, or anyone else who was due a large sum of money, and they direct a paid invoice to their account.

How Does Invoice Fraud Work?

1. You may be communicating with a company or person about paying an invoice for work or a service they have completed for you.  
2. The fraudsters will insert themselves into the process, usually by finding details online or, more commonly, hacking or spoofing your email address or that of the company or person you are dealing with.  
3. From this, they will know that you are planning to send money in the next few days or weeks and will email you pretending to be the company or individual you are dealing with.  
4. They will either use a very similar email (one letter difference) or claim they have a new email address and that you can communicate with them through the new email.  
5. After this, they will send an invoice for the payment. Believing you are dealing with a legitimate person or company, you will send the money and pay the invoice, unknowingly paying a fraudster instead of the legitimate recipient.  
6. Subsequently, the legitimate person or company will contact you, asking why you haven’t made payment yet. This is when the realisation that you have been the victim of an invoice scam occurs.

Types of Invoice Fraud

Invoice fraud is not typically a single, isolated incident; it can be a lengthy tactic used by criminals to reroute a legitimate payment, or manufacture a fake one before anyone notices. Three main types of invoice scams cover the main basis of the scam: 

Invoice Redirection / Mandate Fraud 

• This can be one of the most financially and emotionally damaging types of invoice fraud. A fraudster would intercept correspondence between yourself and a supplier or solicitor, for example. They would identify that you are due to pay an invoice soon, and they would then send the victim ‘new’ bank details, which will be directed to the fraudster’s account.  
• It is especially damaging to home buyers, who have saved up for a house deposit, only to find out they sent it to the wrong account and it has been lost.  
• What makes the mandate fraud effective is that it seems normal from the outside – a simple change of bank details, and you don’t see any red flags. Remember to always verify change of bank details through a verified phone number.

Fake Invoice Scams

• Within fake invoice scams, this is when a fraudster sends an unsolicited invoice, hoping that it will be paid without any checks. This is particularly common within busy companies with high volumes of invoice requests.  
• Scammers regularly use trusted payment or document services such as DocuSign or PayPal to make it seem legitimate. 

Invoice Manipulation and Internal Fraud 

• Unlike the two types of invoice fraud above, invoice manipulation and internal fraud do not require an external attacker impersonating anyone. They instead exploit weaknesses in a business’s own approval and payment processes, sometimes with an insider involved.  

Common types of invoice manipulation can include:  

• Padded amounts – a legitimate invoice altered to inflate the total before payment.  
• Duplicate billing – the same invoice submitted and paid twice, often by error or design.  
• Fake vendor schemes – a fraudulent supplier is added to the payment system (often by someone with internal access) and paid for goods or services that don’t exist.

How To Detect and Prevent Invoice Fraud

It is more important than ever to know how to detect and prevent invoice fraud. Prevention controls stop most fraud before it reaches payment, whilst detection skills catch what slips through the net.

Verification callbacks on known numbers  

• If a supplier, solicitor, or contractor emails to say their bank details have changed, always verify this by calling them on a known number to confirm.  

Dual authentication for payment detail changes  

• Any change to a supplier's payment details should require dual authentication sign-off before updating and sending money.  

Supplier detail change controls  

• Beyond dual authentication, businesses may benefit from a formal change process such as logging changes, timestamping against a known supplier, and reviewing periodically against known supplier documentation.  

Spotting discrepancies in fonts/email addresses/amounts  

• Fake and altered invoices often contain small inconsistencies that are sometimes hard to spot. It is always good to check; the font matches that of previous verified emails, email addresses, and invoice amounts match completely.  

Test payments  

• When sending large amounts, for a house purchase or similar, always send small amounts first and check with the recipient if this was received.

How to Report Invoice Fraud

If you have been the victim of invoice fraud, there are certain steps you should take to report this to the relevant authorities: 

• Report it to Report Fraud
• Report it to your bank
• Report to the legitimate recipient 
• Internal escalation (for businesses)

Can You Get Your Money Back After Invoice Fraud? 

If you sent the funds from a UK bank account, you may be protected. New reimbursement rules for Authorised Push Payment (APP) fraud in the UK have significantly improved victims’ chances of recovering lost funds.

Many victims are not aware that they now have a legal right for reimbursement under new APP fraud reimbursement rules introduced in October 2024.

Key parts of the Mandatory Reimbursement rules:

• You made the payment after the 7th of October 2024
• Your payment was sent to another UK bank account
• Maximum refund of £85,000 per claim
• Banks can deduct an excess of £100 (doesn’t apply to vulnerable customers)
• Victims must report the scam within 13 months of the last payment
• Banks cannot delay the claim indefinitely
• Only applies to micro-enterprises and charities 

It is a free process to claim yourself to your bank and the financial ombudsman. We have written a guide here on how you can do this. 

How Refundee can help 

You can also use an FCA regulated claims management company like Refundee to help you recover your money. 

We are specialists in fraud recovery and UK banking regulations, and we have recovered over £140 million for clients to date.

Start your free eligibility assessment here 

Conclusion 

Invoice fraud can be very damaging, both emotionally and financially. It is important, whether you are a business or an individual, to always verify new payment details before sending any money.  

If you have already lost money, then do not panic; you may have options to recover from this.

More about Refundee 

Here are the technical bits: 

Refundee Ltd is a claims management company authorised and regulated by the Financial Conduct Authority in respect of regulated claims management activity FRN: 937096. 

Registered with the Information Commissioner's Office; registration number: A8986071. 

Registered office address: Refundee, 3rd Floor, 86-90 Paul Street, London, EC2A 4NE. 

Registered as a company in England & Wales; number: 12855931.