Financial Crime

Invoice fraud is when a criminal poses as a legitimate supplier to a business in order to divert payments.

Criminals who specialise in this type of fraud are often aware of the relationships between companies and their suppliers, knowing when regular payments are due. Equipped with sophisticated information, they make contact with finance teams, posing convincingly as suppliers, having the bank details changed to their own.

Payments can sometimes be repeatedly made to them, with the fraud is often only discovered at the point when the legitimate supplier of the product or service chases for non-payment of invoice.

It’s very tough to spot as criminals have gotten very good at disguising themselves, but as long as you make sure you check all requests thoroughly you should be able to protect yourself and your company.

If you see attempts of invoice fraud coming into your business, it’s vital that you let colleagues know what to look out for themselves – if they’re trying to contact you they’ll be likely trying to contact others within the organisation too.

Make sure you have a rigorous procedure in place for validating requests to change supplier bank details. It may feel like a pain for those genuine requests, but it really is better to be safe than sorry because getting those funds back from the fraudulent account is very difficult. Your bank are unlikely to offer a refund for any funds lost.

If a supplier contacts you to make a formal request for bank account details to be changed, always verify with that supplier using their on-file details.

It’s important that everyone inside a business is warned of the dangers of invoice fraud, and that everyone knows to always check invoices to identify potentially fraudulent transactions as soon as possible.

If you think you may have fallen victim to a scam and funds have already been sent, report it immediately to your bank or financial services provider and then contact Action Fraud. It’s also vital to that you let any other relevant colleagues know so that they are aware to be vigilant.

Always read electronic communications carefully. If you spot anything that’s out of the ordinary, such as a spelling mistake or an apparent lack of personalisation (ie referring to you as a valued customer instead of by your name), be careful.

Also, compare this communication against previous genuine ones if you still have them stored – have they changed their approach? Their branding? Their tone of voice? If so, proceed with caution.

If there’s any doubt about it, don’t do what the communication asks of you. Either call the company directly on a number you know is legitimate (not one provided on the email) and never click links or open attachments. Whatever the communication is, you should be able to find reference to it some other way, whether that’s by visiting the company’s website directly or speaking to them on the phone.

If you do notice anything suspicious, the main thing is not to click any links, call any numbers or open any attachments. This is how they gather the information from you.

Instead, report it to your information security or IT department. If your business doesn’t have anyone internally who would deal with this, report it as spam in your email client.

Report it to the relevant department, they may be able to blacklist senders,the best advice in this case is just to remain vigilant to avoid getting caught out.

If you have already given your personal details away, including any bank account information, contact the fraud team of the associated bank for advice and to alert them. You can also request a protective registration marker be placed on your credit file, this will ensure you are alerted should any new applications be made using your details. Please visit Cifas.

Just because someone knows some details regarding your business - such as the address, your relationship manager or suppliers – does not mean they are genuine.

Banks or trusted organisations will never contact you asking for your online security credentials including full password, or to transfer money to a safe account.

Never give out your personal or financial details unless you are absolutely sure you know who you are dealing with.

Always question uninvited approaches asking for information – it could be a scam. Instead, contact the company directly using a trusted email or phone number to check the request is genuine.

If you think there has been fraud on your bank account – or if you suspect anyone has attempted to compromise your financial details – report it immediately to your bank or financial services provider and then contact Action Fraud.

Trust your instincts: If something feels wrong then it is usually right to question it, if you feel under pressure to act quickly then this can be a warning sign something isn’t right.

Stay in control: Be confident - refuse unusual requests for personal or financial information. It’s okay to stop the discussion if you do not feel in control of it.

Crucially, ensure that any colleagues in your own business with financial control are aware of the risks and would know how to spot something suspicious.