FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Crime and fraud
When a business pays a fraudster after supplier bank details are changed, the loss usually stays with the business that paid, not with its bank. Recovery routes are narrow, so controls and the right insurance decide whether the loss is survivable.
Part of: Commercial crime insurance
In short
Invoice redirection fraud happens when a criminal persuades you that a genuine supplier has changed its bank account. Because you authorised the payment yourself, the Supreme Court in Philipp v Barclays (2023) confirmed your bank's basic duty is to carry out your instruction. Statutory reimbursement from 7 October 2024 only protects consumers, micro-enterprises and small charities, capped at £85,000. Most businesses therefore rely on their own controls and on a crime policy with social engineering cover, or a cyber policy with a funds transfer section. Cover is subject to the insurer's acceptance and the policy terms.
The fraudster needs two things: knowledge that you owe a supplier money, and a convincing message telling you to pay somewhere new. That knowledge often comes from a compromised email account, either yours or your supplier's, but it can also come from public tender records or a phone call to your accounts team.
Illustrative: a building contractor receives an email that appears to come from its regular steel supplier, on the usual thread, with a letterhead attached, saying the supplier has moved banks. The next two invoices, totalling £48,000, are paid to the new account. Three weeks later the real supplier chases payment. The money has already been moved on from the receiving account.
For a short definition, see invoice redirection fraud in our wiki. The same pattern appears as fake solicitors' completion emails, fake landlord rent changes and fake payroll bureau requests. For the impersonation of your own directors, see CEO fraud and deepfake payment scams.
In most cases the supplier will say it has not been paid, and the starting point is that paying a stranger's account does not usually settle a debt owed to someone else. Unless your contract says otherwise, you may still owe the invoice. This is a question of contract and the facts, so take legal advice before agreeing anything.
The argument shifts where the supplier's own systems were compromised and the fake instruction came from its genuine mailbox. Some suppliers accept a share of the loss commercially to keep the relationship. Others rely on their terms, which increasingly say bank details will never be changed by email.
If your email was the one compromised and a customer paid a fraudster as a result, the customer may claim against you. That is a liability question, which is where the overlap between cyber and crime cover matters most.
In Philipp v Barclays Bank UK plc [2023] UKSC 25, decided on 12 July 2023, fraudsters persuaded a customer to send £700,000 in two payments to accounts in the United Arab Emirates. The Supreme Court held that where a customer personally and clearly authorises a payment, the bank owes no duty to refuse it. Where an account is in credit, the bank's duty is to execute the instruction.
The so-called Quincecare duty survives in a narrower form: it can apply where an agent, such as a company officer, gives the instruction and the bank has reasonable grounds to believe that agent is defrauding the customer. In a typical invoice fraud, your employee has been deceived rather than acting dishonestly, so that route will often be difficult.
The court did allow a separate claim to go to trial on whether the bank should have tried sooner to recall the money. That is a reminder to call your bank's fraud line immediately: speed is the most practical recovery tool you have.
Section 72 of the Financial Services and Markets Act 2023 provides for mandatory reimbursement, delivered through the Payment Systems Regulator's reimbursement requirement, which applies to Faster Payments and CHAPS payments made on or after 7 October 2024. According to the PSR's guidance, it protects individuals, micro-enterprises and charities, up to £85,000 per claim, and it does not cover international payments.
Under the Payment Services Regulations 2017, a charity qualifies only if its annual income is less than £1 million, and micro-enterprise status follows the EU definition of fewer than 10 staff and turnover or balance sheet of no more than €2 million. Most trading companies are outside it. The detail is in APP fraud reimbursement for businesses.
Standard crime wordings often exclude losses where your staff voluntarily handed over money because they were tricked. Cover for this usually sits in a social engineering or fake instruction extension, frequently with a lower sub-limit. Cyber policies may include a funds transfer fraud or social engineering section, but not all do. See social engineering and fund transfer fraud.
| Situation | Crime policy | Cyber policy |
|---|---|---|
| You pay a fake supplier account after a convincing email | Usually only under a social engineering extension, often sub-limited | Sometimes, if a funds transfer or social engineering section is bought |
| A hacker logs into your banking and sends payments | Commonly under computer or funds transfer fraud | Often, depending on the wording |
| Your hacked mailbox causes a customer to pay a fraudster | Rarely; crime covers your own loss | May respond under liability sections, subject to terms |
| Investigating how your email was compromised | Not usually | Commonly, under incident response |
A fuller comparison is in crime vs cyber insurance for payment fraud.
Social engineering cover is often conditional on verification procedures, and a claim can fail if the procedure was not followed. Typical requirements include:
Confirmation of Payee checks the account name against the payee. The PSR required directed payment providers to offer it by 31 October 2024, and its October 2026 policy statement removed the requirement's expiry date. It covers most Faster Payments and CHAPS payments, but a match does not prove the request is genuine. Read social engineering cover conditions before renewal.
Apex arranges commercial crime insurance and fraud cover, including social engineering and invoice fraud extensions. A broker reads each enquiry and comes back with options, and there is no fee for a quote. Cover is subject to the insurer's acceptance and the policy terms. To quote we need your business activities, turnover, location and claims history, plus your payment volumes, verification procedures and the sub-limit you want for social engineering.
See also: UK business fraud statistics
Often yes. Paying a fraudster's account does not usually discharge a debt owed to your real supplier, unless your contract or the facts point the other way, for example where the supplier's own genuine mailbox sent the false instruction. Some suppliers agree a commercial split. Take legal advice before admitting anything, and tell your insurer promptly.
Rarely, unless you are a micro-enterprise or small charity within the PSR reimbursement rules. After Philipp v Barclays, a bank following a customer's own clear instruction generally owes no duty to refuse it. Contact the bank's fraud team immediately, because a quick recall attempt is the most realistic way to recover money still in the receiving account.
Not automatically. Property and liability policies do not usually cover it, and many crime wordings exclude voluntary payments made after deception unless a social engineering extension is added. Some cyber policies include a funds transfer section. Cover depends on the wording and is subject to the insurer's acceptance and the policy terms.
Commonly a call-back to a known number already held on file, dual sign-off for any new or changed payee, and a written procedure that staff are trained on. Some wordings make this a condition, so a claim may be declined if the call-back did not happen. Keep evidence that each check was carried out.
It is one type of authorised push payment fraud, because you authorise the transfer yourself after being deceived. The statutory reimbursement rules for APP fraud apply to Faster Payments and CHAPS made on or after 7 October 2024, but only for individuals, micro-enterprises and charities with annual income under £1 million.
Tell us what your business does, your turnover and any claims. A broker reads every enquiry and comes back with options. No fee for a quote. Or call 0117 325 0027.
Start a commercial enquiry Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.
