It’s December. Half the office is on leave, the other half is at the Christmas lunch, and someone in finance gets a polite email from a regular supplier: “We’ve changed banks. Please use the new details below for the attached invoice.” It looks right. It’s urgent. It gets paid.

That’s invoice fraud, and for a small business it’s one of the most expensive emails you’ll ever open. The good news is that a handful of dull, reliable habits stop a lot of it. Here’s what it looks like and what to put in place before the break.

What invoice fraud looks like

Invoice fraud is a type of authorised push payment (APP) fraud: you’re tricked into sending the money yourself. The common versions are:

• The bank details change scam. A “supplier” tells you their account has changed. This is often called mandate fraud.
• The spoofed or hijacked supplier. The email really does come from your supplier’s mailbox, because a criminal has broken into it and is replying inside a genuine thread.
• The fake boss request. A message that appears to come from a director asks for an urgent, confidential payment. This is the classic business email compromise.
• The lookalike domain. The sender’s address is one letter off, such as an “rn” standing in for an “m”, or a different ending on the domain.

The NCSC describes business email compromise as a criminal getting into a work email account to trick someone into transferring money, or to steal valuable data. It says these attacks are often aimed at senior staff and anyone who can authorise payments.

Why the run-up to Christmas is the riskiest time

Fraudsters don’t need clever technology. They need busy people, and the weeks before the Christmas shutdown have plenty:

• Rushed approvals. Everyone wants invoices cleared before the office closes.
• Cover staff. The person who normally pays suppliers is on leave, and their stand-in doesn’t know what “normal” looks like.
• Year-end invoices. More bills arriving means one more doesn’t stand out.
• Fewer people to ask. If the director is away, a “please just pay this” email is harder to check.

So set up your checks well before the break, while things are still calm.

The one rule that matters most

If you remember one thing, make it this:

Never change a supplier’s bank details because of an email. Call them back on a number you already hold.

Not the number in the email or its signature. Use the one on your supplier record, an old invoice, or a website you’ve looked up yourself, and ask someone you know whether the change is real.

Write it down, tell everyone who pays bills, and back them when they delay a payment to check. A genuine supplier will understand. A fraudster won’t wait.

Microsoft 365 settings that help

Microsoft 365 won’t stop every fake invoice, but the right settings make the fraudster’s job harder.

Turn on MFA everywhere

Supplier-hijack scams often start with a stolen password. Multi-factor authentication on every account makes a stolen password far less useful. The NCSC says two-step verification keeps criminals out even if they know your password, and recommends passkeys where your email provider supports them. We’ve covered the methods to use in our guide to Microsoft’s SMS MFA retirement.

Tag external senders

Exchange Online can mark emails from outside your organisation as “External” in Outlook. When a “director” email arrives with that label, staff have a reason to pause.

Use impersonation protection

Microsoft Defender for Office 365 anti-phishing policies can protect named people, such as your directors, and your own domains against impersonation. You choose who to protect, as no one is set up by default. Every Microsoft 365 mailbox also gets spoof intelligence and a “first contact” safety tip that warns staff when they don’t often get email from a sender.

Protect your own domain with SPF, DKIM and DMARC

These records make it harder for criminals to send email that pretends to come from your domain. The NCSC advises protecting all of your organisation’s domains this way, including those on Microsoft 365, and offers a free email security check. Microsoft Learn sets out how to configure all three for Microsoft 365.

Alert on new forwarding rules

Criminals in a mailbox may set up rules that quietly forward emails elsewhere, so they can follow the conversation unseen. Microsoft 365 has alert policies for new forwarding or redirect rules and for suspicious email forwarding, depending on your licence. Make sure someone actually reads those alerts.

If you’d like this tidied up properly, it’s part of what we do in cyber security.

A simple payment approval process for small teams

Preventing invoice fraud in a small business doesn’t need a finance department, just a short process everyone follows:

1. Two people sign off any payment over an amount your business decides, and any change to bank details at all.
2. Call back on a known number before any new or changed payee is paid.
3. Treat Confirmation of Payee warnings seriously. Confirmation of Payee checks the name, and whether it’s a personal or business account, against the receiving account before you pay. A “no match” or “close match” message is a reason to stop and call, not click through. A match isn’t the all-clear, though. If the new details arrived by email, banks still advise calling the payee on a number you know is genuine.
4. Pay a small test amount first for new payees, and confirm by phone that it arrived.
5. Write it down so cover staff follow the same steps.

A small life sciences company paying a lab supplier needs the same call-back rule as a café paying its baker.

What to do if you’ve paid a fraudster

Speed matters more than anything else.

1. Call your bank straight away, using the number on its official website or the back of your card. Ask them to try to stop or recover the payment. Tell whoever looks after your IT too.
2. Report it. In England, Wales and Northern Ireland, report to Report Fraud, which replaced Action Fraud in December 2025, at reportfraud.police.uk or on 0300 123 2040. In Scotland, call Police Scotland on 101.
3. Forward the suspicious email to report@phishing.gov.uk, the NCSC’s suspicious email reporting address. This doesn’t report a crime, so do step 2 as well.
4. Secure the mailbox. Reset passwords, sign the account out everywhere, check MFA, and look for forwarding or inbox rules you didn’t create.
5. Warn suppliers and customers if your own mailbox may have been used.

A short pre-Christmas checklist

• Written call-back rule for every bank details change
• Two-person sign-off agreed and shared with cover staff
• MFA on every Microsoft 365 account
• External sender tagging switched on
• Impersonation protection set for directors and finance staff
• SPF, DKIM and DMARC in place on your domain
• Alerts on new forwarding rules and suspicious forwarding, with a named person reading them
• Report Fraud and your bank’s fraud number pinned where finance staff can find them

FAQs

Will my bank refund me if we pay a fake invoice?

It depends who you are and how you paid. Since 7 October 2024, the PSR’s mandatory APP fraud reimbursement rules cover individuals, micro-enterprises and charities paying from one UK account to another by Faster Payments or CHAPS. There’s a maximum per claim, banks can apply an optional excess, and a bank can turn down a claim made more than 13 months after the last payment. Larger businesses, card payments and international transfers aren’t covered by those rules. Ask your bank either way.

How can I tell if a supplier’s bank details change is genuine?

Call the supplier on a number you already hold, not one from the email, and speak to someone you know. If you can’t confirm it, don’t pay.

Does Microsoft 365 stop invoice fraud on its own?

No. MFA, impersonation protection and DMARC reduce the risk, but an email from a genuinely hijacked supplier mailbox can still get through. Your payment process is the real safety net.

What should I do in the first hour after paying a fraudster?

Call your bank, report to Report Fraud (or Police Scotland on 101), forward the email to report@phishing.gov.uk, and secure the mailbox.

Is invoice fraud covered by cyber insurance?

It depends on your policy wording. Ask your broker whether payment fraud is covered and whether any conditions apply, such as call-back checks.

How Cambition can help

We’ll check your Microsoft 365 email protection, switch on the settings above and help you set up a simple payment-change process before the Christmas break.

Book a fit call on 01223 656 156, email ambitious@cambition.co.uk, or get in touch.