Supplier bank detail fraud: a 10-point checklist for AP teams

1. Why it matters

In 2025, UK businesses lost £28 million to invoice and mandate scams across 1,217 confirmed cases, an average of about £23,000 per case. In each one, someone in finance paid a real invoice to the wrong account.

Banks can sometimes recover the money, but not always. The most reliable control is your own process.

2. The 10-point checklist

1. Never act on an email alone. Treat every request to change bank details as suspicious until it’s verified.
2. Call back on a number you already hold. Use the number in your supplier record, not the one in the email.
3. Speak to someone you know. Confirm with an existing contact at the supplier, not whoever sent the request.
4. Split the jobs. The person who logs a change shouldn’t approve it, and neither should release the payment.
5. Check the name matches the account. Use Confirmation of Payee before the first payment, and stop if the name doesn’t match.
6. Know the red flags. Urgency, a sender address one character off, a change just before a big payment run, a request to keep it quiet.
7. Hold the first payment. Send a small test amount, or hold the first payment until the supplier confirms receipt.
8. Log every change. Who asked, who checked, how and when.
9. Review your supplier records regularly. Look for shared bank accounts and dormant suppliers that suddenly need paying.
10. Give your team permission to slow down. Fraud works on pressure.

3. Make the checks part of the process

A checklist works when people remember it. Fraudsters time their requests for when they won’t: month-end, holidays, a new starter on the team. The safest checks are built into the workflow, so nobody has to remember them.

Financial Controller? Read the controls a Financial Controller should own.