FCA authorised · FRN 724952 0117 325 0027Quote & buy →
Wiki: crime and fraud
Invoice redirection fraud, also called mandate fraud, is when a criminal poses as a genuine supplier and persuades a business to pay a real invoice into the criminal's bank account. The payer usually carries the loss.
Part of: Commercial crime insurance
In short
Invoice redirection fraud is a form of authorised push payment fraud: the victim sends the money itself, believing the new bank details are genuine. Fraudsters usually rely on a compromised or spoofed email account. In the UK, banks following a customer's clear instruction generally owe no duty to refuse it, and statutory reimbursement covers only individuals, micro-enterprises and small charities. Businesses normally protect themselves with verification controls and a crime policy that includes social engineering cover, subject to the insurer's acceptance and the policy terms.
Invoice redirection fraud happens when a business receives a request, apparently from a supplier it already pays, to send future payments to a different account. The invoice itself is often genuine. Only the bank details are false. It is a type of fraud by false representation under section 2 of the Fraud Act 2006.
Illustrative: a dental practice gets an email on its usual thread with a laboratory, saying the laboratory has changed banks. The practice pays the next two invoices to the new account. The laboratory later chases payment and the money has gone.
More detail: invoice redirection fraud: who pays and APP fraud reimbursement for businesses.
Standard crime wordings often exclude money handed over voluntarily after deception, so cover usually needs a social engineering extension on a commercial crime policy, or a cyber crime section on a cyber policy. Those extensions are commonly sub-limited and conditional on a call-back check to a number already held. Compare the options in crime vs cyber insurance for payment fraud, check the conditions insurers attach and see social engineering and fund transfer fraud. Related terms: funds transfer fraud cover and CEO fraud.
Apex arranges commercial crime and fraud cover, including social engineering and invoice fraud extensions. A broker reads each enquiry and comes back with options, with no fee for a quote, and cover is subject to the insurer's acceptance and the policy terms. We need your business activities, turnover, location and claims history, plus your payment volumes and verification procedures.
It is often called mandate fraud, supplier impersonation fraud or payment diversion fraud. When it is carried out by hacking or spoofing email, it is also described as business email compromise. All of these are forms of authorised push payment fraud, because the victim sends the money itself.
It can be, usually through a social engineering extension on a commercial crime policy or a cyber crime section on a cyber policy. Standard wordings often exclude voluntary payments made after deception. Cover is commonly sub-limited and conditional on verification checks, and is subject to the insurer's acceptance and the policy terms.
The most common control is calling the supplier back on a number already held before changing any bank details, never using contact details in the request. Dual authorisation for new or changed payees and checking Confirmation of Payee results add further layers. Train staff and keep records of each check.
Usually only for individuals, micro-enterprises and charities with annual income under £1 million, under the PSR reimbursement rules for UK payments made on or after 7 October 2024, up to £85,000. Other businesses generally have no right to a refund, though contacting the bank quickly may allow funds to be recalled.
Call your bank's fraud team at once and ask it to recall the payment, because speed improves the chance of recovery. Report the fraud to the police, preserve the emails with their headers, tell the genuine supplier, and notify your crime and cyber insurers promptly under the policy conditions.
Tell us what your business does, your turnover and any claims. A broker reads every enquiry and comes back with options. No fee for a quote. Or call 0117 325 0027.
Start a commercial enquiry Request a callbackApex Insurance Brokers Limited is authorised and regulated by the Financial Conduct Authority. Registered in England and Wales, company number 07014570. This page is general information, not advice on your individual circumstances, and it does not guarantee that cover will be available or on what terms.
