A supplier email that looks completely normal can now be one of the most expensive messages your business receives. It may use the right logo, refer to a genuine project, mirror a director’s tone and arrive at the point when an invoice is due. It may even be followed by a convincing phone call. The instruction is simple: update the supplier’s bank details and send the payment today.
That is the essence of payment diversion fraud. Criminals impersonate a supplier, customer, colleague or senior decision-maker to redirect a legitimate payment into an account they control. It is often called invoice fraud, mandate fraud or business email compromise (BEC). The National Cyber Security Centre explains that attackers may impersonate contacts an organisation corresponds with regularly and ask for payment to a different bank account. Its guidance on business payment fraud is clear: a message can look tailored and credible without being genuine.
Artificial intelligence has raised the quality and speed of some fraud attempts. It can help criminals produce more polished wording, tailor messages using publicly available information, create plausible documents and, in some cases, generate convincing audio or visual impersonations. But it does not magically defeat a sound finance process. A criminal still needs someone to trust an instruction, bypass a control or authorise a transfer. For an owner-managed firm, the most reliable defence is therefore not trying to spot every fake. It is designing a payment process in which a persuasive email, call or invoice cannot change where money goes on its own.
This matters well beyond large companies. The government’s Cyber Security Breaches Survey 2025 found that 43% of UK businesses identified a cyber security breach or attack in the previous 12 months. Phishing was by far the most common type among affected businesses. Small firms may have fewer people and less formal separation of duties, which makes practical payment controls especially important.
Why AI can make payment fraud harder to recognise
Traditional scam warnings still matter. Odd spelling, generic greetings, poor-quality branding and implausible requests can all expose a fraud attempt. However, relying on those signs alone is no longer enough. Generative AI tools can help a criminal turn rough source material into fluent, professional English in seconds. They can adjust phrasing for a British audience, create several versions of a message and imitate the general style of an organisation’s invoices or routine emails.
That does not mean every well-written email is AI-generated, or that every fraudster has sophisticated tools. Many attacks remain basic. The point is more practical: grammar is a weak authentication method. A message should not be trusted merely because it is polished, personal and consistent with a real supplier relationship.
The UK government’s Stop! Think Fraud guidance for businesses warns that criminals can use cyber tools and AI to create highly realistic fake documents and impersonations. It identifies both CEO fraud, where staff are pressured into urgent payments, and invoice fraud, where a supplier email account may be compromised or a lookalike domain used to send amended bank details.
Three ways the attack may arrive
Supplier invoice redirection. Accounts receives an email apparently from a long-standing supplier stating that its bank has changed, perhaps due to an “audit”, “security upgrade” or “new finance system”. The email includes a revised invoice or a professional-looking bank-details form. If staff amend the supplier record and pay as normal, the money is diverted.
Business email compromise. Instead of spoofing an address, an attacker gains access to a real mailbox belonging to a supplier or a member of your own team. They can read previous messages, learn invoice cycles and insert themselves into an existing thread. This is particularly dangerous because a reply to the email may simply go back to the criminal-controlled account.
Executive or colleague impersonation. A message, WhatsApp request or phone call appears to come from the owner, finance director or project lead. It asks for a confidential, urgent payment and discourages normal checks: “I’m in a meeting, just get it done” or “Do not copy anyone else in yet.” AI can make the wording sound more natural. A synthetic voice may make a call feel more credible. But urgency and secrecy remain warning signs, not reasons to suspend controls.
The core rule: treat bank-detail changes as high-risk events
An invoice is not proof that a bank account belongs to the supplier named on it. Nor is an email from a familiar address. A bank-detail change is an instruction to alter a trusted payment destination, so it deserves its own verification procedure every time.
Adopt one non-negotiable rule: no bank-details change is actioned solely on the basis of an email, attachment, text message, portal message or inbound phone call. This applies even when the request appears to come from a known contact and even when the invoice itself is legitimate.
Government business guidance makes the same distinction: verify payment requests by phoning a trusted contact at the organisation concerned, and do not verify by replying to the original email or message because the address may have been cloned or hacked. Read the official advice on verifying payment requests with your finance team and turn it into a written local rule.
Use independently confirmed contact details
The word “independent” is critical. Do not call the number in the email footer, attached letter or revised invoice. Do not use a web link supplied in the request. A fraudster controls those routes.
Instead, call a number already held in your accounting system, in the signed supplier onboarding record, on a previous verified contract, or found independently through the supplier’s established website. If you have no trusted number, pause the payment until you can obtain and verify one. For a major supplier, consider requiring confirmation from two known contacts, such as the account manager and finance office.
During the call, ask the supplier to confirm the legal entity name, the exact account name, sort code and account number, the date the change took effect and the reason for it. Avoid reading the proposed details out first where possible. Ask the contact to state them, then compare their answer against the submitted change request. Record who completed the check, which independently sourced number was used, when it occurred and what was confirmed.
A payment-verification process that works for owner-managed firms
Controls need to be robust, but they do not need to create a corporate bureaucracy. The following process is designed for firms where the owner, bookkeeper, office manager or a small finance team carries several responsibilities. Scale the approval limits to your cash flow, but keep the principles intact.
Step 1: Separate the invoice from the bank-change request
Match the invoice to the purchase order, contract, goods received note, timesheet or other evidence that the work or goods are genuine. This is the ordinary “three-way match” in a form suitable for your business. It answers: do we owe this supplier this amount?
Then treat the bank-detail amendment as a separate question: do these payment details genuinely belong to that supplier? A genuine invoice can be used as the vehicle for a false bank account. Both questions must be answered before payment is released.
Step 2: Put supplier changes in a controlled queue
Do not allow staff to overwrite supplier bank details immediately. Use a simple change log or dedicated inbox monitored by at least two people. Every request should include the supplier name, current details on file, proposed details, invoice references, date received, requester, verification status and approver.
Set the supplier record to “payment hold – bank change pending” until the callback is complete. This prevents an invoice from being paid automatically or accidentally under the new details. If a supplier claims the matter is urgent, that is a reason to accelerate your independent verification, not to waive it.
Step 3: Complete an out-of-band supplier callback
“Out-of-band” simply means using a separate, trusted communication channel. The person who received the email should not be the only person completing the check if your staffing allows it. A different team member, director or external bookkeeper can make the callback and document the result.
Use a standard script. Confirm that the supplier requested the change; confirm the account details; confirm the name and job title of the person authorising it; and ask whether the supplier has experienced any recent email-security issue. If the contact cannot verify the change, says they did not request it, or seems uncertain, stop the process and escalate immediately.
Step 4: Require dual approval before details are changed
One person may enter the amendment, but another authorised person should approve it before it becomes active. The approver must be able to see the callback evidence, not merely a note saying “checked”. For a microbusiness with only one employee handling finance, the owner or a retained accountant should provide the second approval. If that is not possible before a payment deadline, delay the change rather than creating an exception that criminals can exploit.
Use banking and accounting permissions to support the policy. Ideally, no single user can create a new payee, amend an existing supplier’s bank details and release the payment. Many online banking platforms offer maker-checker permissions, payment limits or separate approval roles. Ask your bank what is available on your account, then make sure the settings match your written process.
Step 5: Apply a second check when payment is released
The payment approver should compare the beneficiary name and details on the bank screen with the verified change log. They should also ask whether the payment is unusual in amount, timing, frequency or destination. This is not duplication for its own sake; it is the final point at which the money can be stopped.
For higher-risk payments, introduce a short cooling-off period after a bank-detail amendment. For example, do not make the first payment to new supplier details until the next working day after successful verification, unless a director authorises an exception after speaking directly to the supplier. A fraudster’s preferred weapons are pressure and speed. A documented pause removes much of their advantage.
Set approval thresholds and clear escalation rules
Dual approval should be based on risk as well as value. A small payment to newly amended bank details may still be a test transfer by a criminal. Equally, an owner may reasonably approve routine low-value payments without a committee. The answer is a simple, written matrix.
- All bank-detail changes: independent callback, documented evidence and a second approver before activation.
- Any first payment after a change: payment approved by someone other than the person who amended the record.
- Payments above your chosen threshold: two banking approvers, one of whom is an owner or director.
- New suppliers, overseas payments or changes received close to a deadline: director review regardless of value.
- Requests involving secrecy, a personal account, cryptocurrency, gift cards or a last-minute change of destination: stop and escalate; do not “work around” the process.
Write down who staff should contact when something feels wrong. In a small firm, that may be the owner, a named deputy and the outsourced IT provider. Make it explicit that any employee can put a payment on hold without fear of criticism. Staff should never be penalised for delaying a transfer to validate an unusual instruction.
Also establish a “no verbal override” rule. A call claiming to be from the owner does not replace the approval process. If a voice call is used to press for payment, end the call and contact the owner or colleague through a known number or a pre-agreed second channel. The same applies to video calls. Familiarity is not proof of identity.
Protect the email accounts behind your payment process
Verification controls stop a fraudulent instruction from being accepted. Account security reduces the chance that criminals can insert themselves into genuine correspondence in the first place. Start with email accounts used by directors, finance staff, payroll, purchasing staff and anyone who can approve or amend payments.
Require multi-factor authentication (MFA), use strong unique passwords stored in a reputable password manager, promptly remove former staff and review mailbox forwarding rules. An attacker who gains access to a mailbox may create a hidden forwarding rule to monitor invoices, so review these after staff report suspicious activity or after an account reset.
The NCSC’s small business guide provides practical baseline cyber-security actions, while its phishing guidance explains how organisations can reduce exposure to deceptive emails. Apply security updates to laptops, phones, browsers, accounting software and email systems promptly. Keep backups and restrict administrator rights. These measures will not replace finance controls, but together they reduce the attacker’s opportunities.
Train for behaviour, not just red flags
A once-a-year slide deck telling people to look for bad spelling is not enough. Teach staff the behaviour you expect when they receive a payment-related message: stop, use the official process, verify independently and escalate uncertainty. Use short examples drawn from your own workflows: a supplier bank change, an “urgent” director request, a payroll amendment and a customer asking for a refund to a new account.
Brief staff when they join, repeat the message regularly and test the process with a harmless scenario. Make special arrangements for holidays, year-end, trade shows and periods when the owner is travelling. Criminals often exploit assumptions that a busy decision-maker cannot be reached.
What to do if money has already left
Speed matters. Do not wait for the supplier to reply or spend hours proving exactly how the fraud happened. Contact your bank immediately using a trusted number or its official website and state that you believe the payment was fraudulent. Ask it to take urgent action to trace or recall the transfer. The NCSC also advises organisations that have been tricked into making a payment to contact their bank directly through official channels.
Preserve the evidence: emails with full headers where possible, invoices, screenshots, phone numbers, payment confirmations, bank details, dates and names used. Tell your IT support provider so it can secure affected accounts, reset credentials, check for mailbox rules and review whether any other payment instructions were intercepted.
Report the incident or attempt through Report Fraud. If personal data may have been exposed, seek appropriate data-protection advice and consider whether a report to the Information Commissioner’s Office is required. Then inform the genuine supplier and relevant customers quickly enough to prevent further misdirected payments or impersonation attempts.
Make payment verification part of how your business operates
AI-enhanced fraud changes the appearance of some attacks, not the fundamentals of how they succeed. A criminal wants a person to believe an unverified instruction and move money before anyone checks it. Your job is to make that route unavailable.
Start this week. List everyone who can create payees, amend supplier records or approve bank transfers. Introduce the independent callback rule for every bank-details change. Turn on dual approval in accounting and banking where possible. Give staff a clear escalation contact. Test the procedure using one supplier record and one mock urgent request.
The process may add a few minutes to a payment. That is a small cost compared with discovering that a genuine invoice has been paid into a criminal account. When money is about to leave the business, trust should be supported by evidence, a second pair of eyes and a verified route back to the real supplier.
