How to spot invoice and bank-detail fraud

Why travel businesses are targeted

Fraudsters go where the money moves quickly. Travel businesses pay many suppliers, often in large sums, on tight deadlines, with invoices that arrive by email. That makes the finance inbox one of the most valuable targets in the business.

The tactics have changed too. Banks have become better at stopping unauthorised payments, so criminals now persuade genuine staff to send the money themselves. Authorised push payment fraud losses in the UK rose 19% to £576.4 million in 2025, according to UK Finance's Annual Fraud Report 2026 (opens in a new tab), which also warns that criminals are using AI to make scams more convincing.

The good news: most of these frauds depend on one moment, when someone pays bank details they received by email. Control that moment and you remove most of the risk.

The three common forms

Ten warning signs

Any one of these is a reason to pause before paying:

1. 1A request to change bank details, however routine it sounds.
2. 2New bank details in a different country, or at a different bank, from before.
3. 3An account name that doesn't quite match the supplier's trading or legal name.
4. 4Pressure to pay today, or a threat that bookings will be cancelled.
5. 5A request to keep the change quiet or to skip the usual approval.
6. 6An email address that's almost right: an extra letter, a different ending, or a reply-to address that differs from the sender.
7. 7An invoice with small differences from the supplier's usual layout, wording or numbering.
8. 8A payment amount that's unusually large, or split oddly across several invoices.
9. 9A message arriving at a busy moment: month end, peak season, or when key staff are away.
10. 10A caller who knows a lot about your business but won't let you call them back on a number you already hold.

None of these proves fraud on its own. Fraudsters rely on each one looking reasonable in isolation.

The one rule that stops most of it

A five-step process for bank-detail changes

Write this down and make it the rule for everyone who can pay suppliers:

1. 1Hold. No payment goes to new bank details until the change is verified.
2. 2Call back. Phone the supplier on a number you already hold and confirm the change with someone you know.
3. 3Second pair of eyes. A second person approves any change to supplier bank details, separate from whoever received the request.
4. 4Record it. Note who verified the change, when and how.
5. 5Consider a check payment. For large payments to newly changed details, you may choose to send a small first payment and confirm receipt with the supplier, again using details you already hold.

Use your bank's payee check

Most UK banks now check the name on the account before you pay, through Confirmation of Payee. In Ireland and across the eurozone, Verification of Payee (opens in a new tab) has applied to euro bank transfers since 9 October 2025.

Take these checks seriously. A “no match” or “close match” result is a reason to stop and verify, never to click through. But remember that a match on its own doesn't prove the request is genuine, so the call-back rule still applies.

If you think you've paid a fraudster

Speed matters. In the first hour:

1. 1Call your bank immediately. Use the number on its website or the back of your card, and ask it to try to stop or recall the payment.
2. 2Report it. In England, Wales and Northern Ireland, report to Report Fraud at reportfraud.police.uk (opens in a new tab) or on 0300 123 2040. In Scotland, call Police Scotland on 101. In Ireland, report to your local Garda station.
3. 3Secure your email. Change passwords, turn on multi-factor authentication and check for unfamiliar forwarding rules.
4. 4Warn the real supplier. Use details you already hold, in case their email has been compromised.
5. 5Keep everything. Save emails, invoices, call logs and payment records.

In the UK, mandatory reimbursement rules for authorised push payment fraud cover individuals, microenterprises and charities. Larger businesses may have no automatic right to get their money back, so prevention matters more.

For suppliers: protect your agents

Fraudsters often pose as suppliers, and when an agent pays a fraudster, you still haven't been paid. You can make that harder:

• Tell your agents, in writing, that you will never change your bank details by email alone.
• Give them a known phone number to verify any request.
• Keep the account name your bank holds in line with the name on your invoices, so payee checks return a clean match.
• Act quickly if you think your email has been compromised, and warn your agents.

Here's a message you can send your agents:

Explore Trade Sellers