By The KTech team · Published 29 October 2026
Invoice fraud, sometimes called payment diversion fraud, is simple and painful. A criminal emails you pretending to be a supplier, a contractor or even your own accountant and says their bank details have changed. You pay the next invoice into the new account and the money is gone.
It affects builders paying suppliers, holiday-let owners paying cleaners and agents, farms paying contractors, and clients paying for a house purchase. Here is how it works, what to look for, and the simple call-back habit that stops most of it.
How the fraud works
There are usually two versions. In the first, the criminal has broken into a mailbox, yours or your supplier's, and quietly reads the email conversation. When an invoice is due they send their own version, using the real thread, with different bank details. Because it arrives in the middle of a genuine conversation, it looks completely normal.
In the second, they never get into anyone's mailbox. They simply pose as a supplier from an email address that looks nearly right, perhaps with one letter changed, and ask you to update your records. Some will phone first to make it more convincing.
Either way, the goal is the same: get you to pay a real invoice into the wrong account. The money is usually moved on quickly, which is why speed matters if it happens.
Signs that something is wrong
- A change of bank details by email, particularly one that comes with urgency.
- A sender address that differs slightly from the one you normally use.
- A new account that is in a different name from the supplier, or with a bank they have never used.
- Pressure to pay quickly, or a request to keep the change quiet.
- A conversation that suddenly sounds different: odd phrasing, a new signature, or a change in who is writing.
- An invoice that arrives just as one was expected, but with unfamiliar details.
The call-back rule that stops most of it
Make one rule and stick to it: no change of bank details is accepted on the strength of an email alone. Whenever a supplier or client asks to change where money is sent, phone them on a number you already hold, not one in the email, and confirm it before you pay.
Write the rule down and share it with everyone who handles payments, including the person who covers when you are on holiday. It sounds fussy, but it takes two minutes and it is the strongest protection there is.
A few other habits help. Check new account details against the previous invoice. Pay a small test amount first for large payments to a new account. Keep a list of approved suppliers and who is allowed to change their details. And if you are the one sending invoices, mention on them that your bank details never change by email, so customers know what to expect.
Email security matters too
Many cases begin with a hacked mailbox, so protecting your email protects your customers as well. Use a long, unique password for every account, and turn on multi-factor authentication for email. Be careful with log-in links in emails, because fake sign-in pages are how many mailboxes are taken over in the first place.
Watch for signs that a mailbox has been tampered with, such as rules that forward or hide messages, replies you did not write, or contacts telling you they received something odd from you. If you notice any of these, change the password, check the forwarding settings and get help. Our page on cyber threats in the South Hams describes what we see locally.
Our cyber security services cover email protection, staff guidance and secure set-up for small organisations.
If you think you have paid the wrong account
Act at once. Ring your bank immediately and ask them to try to recall the payment, and then report it to Report Fraud through the Report Fraud website. The sooner the bank hears, the better the chance of stopping the money moving on.
Then make sure the mailbox involved is secure, because the criminal may still be reading it. If you would like help checking that, see our hacked help page or give us a call.
Local firms are not immune, and being a small business in a close community can make it easier for a criminal to sound plausible. Whether you are in Kingsbridge, Ivybridge or Dartmouth, a short call-back routine is worth far more than it costs. Our team supports IT and security for Ivybridge businesses and across the South Hams.
Who tends to be targeted
Criminals go where invoices are routine and sums are large enough to be worth the effort. Builders and trades paying for materials, farms paying contractors and feed merchants, holiday-let owners paying agents and cleaners, and small firms paying professional fees all fit the pattern. Anyone buying or selling a property should be especially careful, because large sums move quickly and the paperwork involves several parties.
Being small does not protect you, and being friendly with your suppliers does not either. In fact a long, informal email relationship is exactly what a criminal copies. Treat a request to change bank details as unusual every single time, however well you know the sender.
Make it easy for your own customers
If you send invoices, help your customers avoid being tricked in your name. Put your bank details on every invoice in the same place and format, say clearly that you will never change them by email, and give a phone number they can use to check. Keep the same sender address for invoices rather than switching between several.
If a customer ever tells you they received an invoice from you that looks wrong, take it seriously and treat it as a possible mailbox compromise, because it may mean someone has been reading or sending mail as you.