Changed bank details on an invoice: payment redirection scams

An invoice scam, sometimes called mandate fraud, happens when a criminal poses as someone you legitimately owe money to, such as a builder, solicitor or supplier, and gives you new or amended bank account details to pay into¹. The money leaves your account exactly as you intended, to the sort code and account number you were given, but it lands in the fraudster's account instead. Because you authorised the payment yourself, this is what is known as an authorised push payment scam, and getting the money back is not automatic.

These scams usually begin with a criminal intercepting emails, gaining access to your supplier's email account, or pretending to be from them, which is known as spoofing¹. The fake message often looks identical to the real firm's invoices, because the fraudster has been reading the genuine email thread. House purchases are a particular target: criminals pose as solicitors to trick homebuyers into sending deposit or purchase money to their accounts, and may spend weeks gathering personal information first, using fake invoices or email addresses that closely mimic the real ones².

The single most useful habit is also the simplest: if a company or service provider changes their payment details, always query it, because companies rarely change their bank details¹. This page explains how the scam works, the warning signs, the checks to make before paying, how the Confirmation of Payee name check helps and where it stops, and what to do if you have already paid.

How an invoice scam works: fraudsters pose as someone you owe money to

Invoice or mandate fraud starts with trust. The criminal does not need to trick you into paying a stranger, only into paying a familiar bill into the wrong account. They pose as your builder, solicitor, tradesperson or someone from a trusted organisation, and provide you with new or amended bank account details¹. The invoice looks right, the amount is roughly what you expected, and the email may even sit inside a genuine thread you have been part of for weeks.

The method is usually one of three things: intercepting emails between you and the firm, gaining access to your supplier's email account, or pretending to be from them, which is known as spoofing¹. Interception means the fraudster watches a real conversation and steps in at the moment money is about to change hands. Account access means the emails genuinely come from the supplier's own address, which makes them very hard to spot. Spoofing means the address only looks genuine, with small differences a reader can easily miss under time pressure.

The biggest single payments are at risk during house purchases. Criminals pose as solicitors to trick homebuyers into sending deposit or purchase money to their accounts, and they prepare carefully, sometimes spending weeks gathering personal information to make the scam look believable, using fake invoices or email addresses that closely mimic the real ones². A similar pattern of impersonation appears across other scams: criminals use spoofing to make numbers or emails look legitimate, pressure you into following their instructions, and in banking impersonation cases may tell you your account is at risk and that you must move money to a "safe account"⁶. Delivery scams use the same urgency in miniature, with a message claiming a delivery failed and asking you to pay a fee or follow a link⁷.

The scam is often discovered only when the genuine firm chases the unpaid bill, by which time the money has been moved on. That delay is why prevention matters so much more than cure here: once a payment has been made and the criminal has withdrawn the funds, recovery depends on your bank acting quickly and on how much of the money is still traceable. The steps in the later sections on checking details and Confirmation of Payee are designed to stop the payment leaving your account in the first place.

Warning signs of changed bank details on an invoice

Because the fake invoice is built from a real one, the differences are usually small and contextual rather than obvious. Several warning signs recur across scam types. Common ones include inaccurate spelling and wording, a sense of urgency pushing you to act quickly, requests for bank details or passwords with an instruction not to tell anyone, and an unfamiliar email address⁸. The urgency is the fraudster's main tool: a message saying the payment must be made today, or the deal will fall through, is designed to stop you checking.

The same pressure tactics appear in scams that impersonate official bodies. Messages made to look like they come from a trusted organisation may say a payment has been blocked, that bank details need updating, or that an account will be closed unless the recipient acts immediately⁹. A request to pay by bank transfer rather than a secure payment method is itself a warning sign, as seen in ticket scams where sellers ask for bank transfer instead¹⁰.

Some signs show up after the event rather than on the invoice. Identity theft warning signs include unusual payments or direct debits appearing on your bank statements, important mail going missing, bills arriving for things you have not bought, and new credit cards appearing on your credit record¹¹. The information and communications regulator gives the same advice from the other direction: items you do not recognise appearing on your bank or credit card statement are a sign of identity theft¹². If a fraudster has access to your supplier's email, they may also have access to yours, so an invoice scam can be the visible edge of a wider compromise.

In employment and contractor settings, a related set of signs exists around payslips and payroll. Warning signs include payslips or CIS deduction statements that regularly change format or show different employer names, frequent moves between payroll companies or contractors, vague deductions such as "admin adjustments", take-home pay that does not match hours worked, and being asked to set up your own limited company¹³. These point at fraud against the payer rather than by them, but they share the same root: details that keep changing are rarely a good sign.

Check new bank details before you pay

The check that defeats this scam takes minutes. When anyone emails bank details, the recommended step is to call them to confirm, using a number from their website, not one in the email¹⁴. The distinction matters: the fraudster who sent the invoice can also answer the phone number printed on it. A firm's official website, a previous paper invoice, or a number already on record are the sources guidance points to. Where a message claims to come from a regulated financial firm, the FCA states that contact details can be checked against those listed on its Firm Checker, which catches scammers pretending to be a real firm¹⁵.

For a first payment to a new provider, there is a further safeguard: transfer a small amount first and check the payment has been received directly by the company before sending the rest¹. A builder or solicitor who is genuine will not object to a phone call confirming their account details, and most will welcome it, because they are also victims when the money goes astray.

A numbered routine for any request to change payment details:

1. Stop. Do not pay on the strength of the email alone, however convincing it looks.
2. Find an independent contact route: the firm's official website, a previous invoice, or a known phone number.
3. Call and ask them to confirm the bank details, ideally reading them out to you rather than the other way round.
4. If it is a first payment, send a small test amount and confirm receipt directly with the company¹.
5. Only then pay the balance, and keep a record of the confirmation.

If the message claims to be from a friend or family member needing an urgent transfer, the same rule applies: speak to them directly first to check it is really them⁶. And if someone you do not know is asking you to pay by bank transfer at all, treat that as a possible sign of a scam³. More general warning signs are covered in how to spot a scam, and the technique of checking a caller is genuine is explained in how to check your bank is really contacting you.

Confirmation of Payee: the name check before a new payment

Confirmation of Payee, or CoP, is the banking industry's name checking service, designed to help prevent authorised push payment scams and misdirected payments¹⁶. It works by checking whether the name of the account you are sending money to matches the name you have entered, with alerts notifying you when there has not been a match¹⁷. In practical terms, banks use the service to check whether the name and account type, for example personal or business, you enter when setting up a new payee matches the details registered with the bank receiving the money¹⁸.

The service has existed since 2020, and if the details do not match, a warning is provided before you make the payment¹⁸. It is one of the main tools regulators have pushed to reduce scams: the Payment Systems Regulator describes it as one important tool for preventing authorised push payment scams¹⁹, and as a service that aims to prevent certain types of scams and misdirected payments from happening²⁰.

Coverage has grown in stages. The six largest banking groups were directed to implement the service first, and since then other providers have joined, some voluntarily: 21 non-directed payment service providers implemented it in the first phase²¹, and by a later count 33 PSPs were offering the service⁴. The regulator then extended the requirement to further providers, with deadlines of 12 months for one group and 24 months for another from when its direction was given²¹, and a deadline of 31 October 2024 for the second group of providers to introduce it²². The scale is now substantial: there are more than one million CoP requests every day²³.

The check applies to accounts that allow consumers to transfer funds in and out, such as current accounts and e-money accounts, while mortgage and credit card accounts are excluded²¹. When you set up a new payee or amend an existing one, your bank sends the request and shows you the result before the payment is made. The technical standards behind the service were agreed in work coordinated by Pay.UK and are ready for implementation by banks and other payment service providers¹⁹.

Match, close match or no match: what each result means

When your bank runs the check, the alert tells you one of three things: a match, a close match, or no match, so corrections can be made before the payment is sent¹⁷. Each result means something different, and none of them makes the decision for you.

• Match. The name you entered matches the name registered on the receiving account. The payment can proceed, but no payment is made automatically: even when the name matches, you always have to confirm that you want to go ahead²⁴.
• Close match. The name is similar but not exactly right, for example a shortened version or a small spelling difference. The bank shows you the name the receiving account is actually registered under so you can check it¹⁸.
• No match. The name does not match the account at all. A warning appears before you make the payment¹⁸, and this is the result most often seen when a fraudster's account is being paid.

The result is information, not a barrier. You can still send payments even if you are warned that your payee's details do not match²⁴. That design is deliberate: there are innocent reasons for a close match, such as a trading name or a nickname, and the service is not meant to stop legitimate payments. But it puts the responsibility for the decision on you, which is why a no match result on an invoice with new bank details should always be treated as a stop sign, not a nuisance to click through. What to do at that point is covered in what to do when Confirmation of Payee shows no match.

Where Confirmation of Payee does not protect you

The check has real limits. First, it only applies to payments made in pounds sterling²⁴. Second, it covers new payments, or an amendment to an existing payment, made through Faster Payments or CHAPS; BACS, Direct Debits, direct credits, and bulk and batch payments are not supported at this stage²⁴. International payments in other currencies therefore get no name check at all, a gap covered in more detail in international transfers and scam refund rules.

Second, the check depends on both banks taking part. If you try to pay an individual or business who banks with a provider who does not support Confirmation of Payee, it will not be possible for your bank to check the account details are correct²⁵. Coverage is wide but not total, so a missing check is not proof of anything, only a signal that you must verify the details yourself by other means.

Third, the check only covers the payee's information, not the payment amount²⁵. A fraudster who has taken over a genuine account, or who has registered an account in a name that plausibly matches the firm you owe, can produce a match result. And the service does not prevent every scam even when it works perfectly: asked whether it stops all fraud, one provider's answer is "Unfortunately not, but it's an extra safeguard against it"²⁴.

Some payments are also outside the scope of the rules by design. Bulk payment file submission, unattended payments and any payments processed when the customer is not present are out of scope²¹. Separately, payment regulations require that after a payment is executed the payee's payment service provider must give the payee a transaction reference, the amount, charges, the exchange rate used and the credit value date²⁶, which helps with after-the-fact tracing but does nothing to stop a misdirected payment.

A matching name does not prove the payment is safe

The hardest version of this scam to catch is the one where every technical check passes. Fraudsters can register accounts in names that closely resemble a real firm, or take over a genuine firm's account, and Confirmation of Payee will report a match because the name genuinely matches the account. This is why the phone call to a known number remains the essential check even in a world of name matching.

Impersonation techniques extend well beyond invoices. In investment fraud, a tactic known as spoofing means the caller ID and telephone number seen by an investor is not the scammer's details but legitimate phone numbers used by the Insolvency Service or other organisations²⁷. The same principle applies to email: a message can appear to come from a real organisation while being controlled by someone else. If someone is asking you to pay by bank transfer, it could be a sign that it is a scam³, and that remains true even when the name check passes.

For people receiving money rather than sending it, the check works in the other direction. Give payers the exact name registered on your account, because that is the name their bank will check against. And if your own email has been compromised, the fraudster may be reading your invoices as well as sending them, so inform your bank, building society and credit card company of any unusual transactions on your statement⁵. The wider steps are covered in identity theft: protecting yourself and what to do if it happens.

A related trap follows the scam itself. Fraudsters target people who have already lost money with offers to recover it, and the spoofed phone numbers described above are part of how those approaches look convincing²⁷. Never pay an upfront fee to a firm that promises to recover money you lost to a scam; the dedicated page on recovery room scams and whether to pay a recovery firm explain why.

If you have paid a scammer: what to do straight away

Speed matters more than anything else once money has left your account. The Financial Ombudsman's guidance for scam victims sets out the immediate steps: contact your bank or payment services provider immediately, contact the police on 101, report the scam to Report Fraud, and keep records of all contact and correspondence between you and the scammer²⁸. The bank can attempt to recall the payment and can freeze the receiving account if it is alerted quickly, so the first call is the one that matters.

Before anything else, stop making payments to the person or company you think is scamming you, and cancel the Direct Debit with your bank if one is in place¹⁴. Then:

1. Contact your bank immediately and tell it you have been the victim of a scam payment²⁹.
2. Report to the police: Report Fraud online or on 0300 123 2040³⁰.
3. Keep everything: the emails, the invoice, the payment confirmation and any phone records²⁸.
4. Watch your statements for anything else you do not recognise, and tell your bank about it⁵.

If the payment went to an account that does not exist, the outcome can be simpler: the payment should fail and the money should automatically bounce back to you¹⁸. In an invoice scam that is rarely the case, because the fraudster's account is real and the money is usually moved on quickly. Whether you get your money back then depends on the reimbursement rules for authorised push payment scams, which are covered in how bank transfer refunds work and claiming a refund from your bank. Banks usually refund fraud on unrecognised transactions if they are reported quickly³¹, but a payment you authorised yourself is assessed differently, as explained in authorised and unauthorised payments.

One consequence worth knowing about is the fraud marker. Where a bank records fraud markers against a customer, the consequences can include being unable to open a bank account, having an account closed, or having a mortgage application rejected³². This is aimed mainly at people whose accounts are misused, including money mules, but it is one reason to engage with your bank promptly and fully if you are caught up in a scam. The full first steps are set out in paid a fraudster? what to do straight away.

Reporting an invoice scam to your bank and Report Fraud

Reporting an invoice scam serves two purposes: it gives your bank the chance to recover money, and it helps the authorities build a picture of the criminals. The national reporting centre for fraud in the UK is Report Fraud, formerly known as Action Fraud. If you believe you are a victim of fraud, you can make a report to Report Fraud¹⁵. The Information Commissioner's Office, which handles complaints about fraud and scams alongside data protection matters, also refers complaints about fraud and scams to Report Fraud³³.

The reporting routes are the same across the UK, with some additions in Northern Ireland. Suspicious emails or text messages asking for bank details can be reported online to Report Fraud or by phone on 0300 123 2040, and in Northern Ireland also to the local Jobs and Benefits office³⁴. The police can be contacted on 101 for non-emergencies²⁸. Some organisations have their own reporting channels on top: for scams involving the Insolvency Service, the stated route is to report the incident to Report Fraud as soon as possible and call its Customer Service Team on 0300 678 0015 or complete a general enquiry form³⁵.

Even people who spot the scam in time have something to report. A suspicious message that did not succeed in taking money still helps the authorities, and forwarding suspicious texts to 7726 is covered separately in forwarding suspicious texts to 7726. The full reporting picture, including what happens after you report, is in where to report a scam.

If your bank refuses a refund and you disagree with its decision, the complaint does not end there. You can take a refused scam refund to the Financial Ombudsman, which looks at complaints involving unauthorised payments and identity theft²⁸, and the process is explained in taking a refused scam refund to the Financial Ombudsman. The grounds on which a bank can refuse, including ignoring warnings, are covered in the consumer standard of caution and gross negligence.