Invoice Fraud Detection UK 2026: Spotting Fake Invoices and Mandate Fraud

Three main types: (1) Fake invoice fraud — fraudster impersonates a real supplier and submits a bogus invoice for goods/services not delivered. (2) Mandate fraud — fraudster intercepts real supplier or finance-provider correspondence and changes bank details to redirect legitimate payments. (3) Facility misuse — invoice finance borrower submits non-existent, duplicate or inflated invoices for funding. UK Finance estimated £172m total invoice/mandate fraud loss in 2025.

Red flags: (1) invoice amount or services don't match any purchase order or work record, (2) supplier contact via a new email address or phone number, (3) urgency ('please pay today'), (4) round-number amounts just below your internal approval threshold (£999, £4,999, £9,999), (5) unusual payment instructions ('pay to a different bank account this time'), (6) accountant or finance team unable to find the invoice in your records, (7) supplier name slightly misspelled (Acme Ltd vs Acrne Ltd). Run a Companies House check on any new supplier paying address changes.

A fraudster impersonates a real supplier (or your invoice finance provider, or HMRC) and asks you to change the bank details for future payments. They might intercept email correspondence and send a 'we've changed banks, please update our bank details' message. Future legitimate-looking invoices then redirect payments to the fraudster's account. The real supplier doesn't realise until they chase non-payment weeks later.

Always verify bank-detail change requests by phoning the supplier on a number you already have (not the number on the change request). Treat any change request received only via email as suspect. For invoice finance: confirm any change to the assignment account via your account manager by phone. Consider implementing dual-control payment authorisation for any account change above £5,000. Train AP staff to recognise and escalate change requests.

Invoice finance providers protect themselves through the personal guarantee waiver (PGs are usually called only for fraud or misrepresentation, not normal trading losses), debenture security over company assets, and now post-Greensill heavy automated fraud detection. Providers will refer suspected facility misuse to Action Fraud, City of London Police's PIPCU or specialist commercial fraud solicitors. Civil and criminal proceedings can both follow. Directors are personally exposed via the PG waiver if fraud is proven.

(1) Pause any pending payment immediately. (2) Phone the real supplier on a known number (not the number on the suspect invoice) to verify. (3) Phone your bank's fraud team to flag the payment if already sent (they can sometimes recall within hours). (4) Report to Action Fraud (0300 123 2040 or actionfraud.police.uk). (5) Notify your insurer if you have crime / cyber cover. (6) Notify your invoice finance provider if the fraud relates to one of your facility customers. (7) Document everything for any subsequent recovery action.