Supplier bank detail fraud: the controls a Financial Controller should own

In 2025, UK businesses lost £28 million to invoice and mandate scams across 1,217 confirmed cases, an average of about £23,000 each. In every one, a real invoice was paid into the wrong account.

1. The eight controls

1. A written verification procedure. Every bank detail change is verified by phone, on a number already held, with a known contact.
   Ask your team: “Show me the last three changes and how each one was verified.”
2. Separation of duties. The person who records a change doesn’t approve it, and neither of them releases the payment.
   Ask your team: “Could one person change a supplier’s bank details and pay them today?”
3. Approval for every change to supplier records. Bank details, addresses and contacts changed only with a second person’s approval, and every change logged.
   Ask your team: “Where’s the log, and who reviews it?”
4. Checks before the first payment. Confirmation of Payee before paying new details, and the first payment held or tested until the supplier confirms receipt.
   Ask your team: “What happens to the first payment after a change?”
5. A regular review of supplier records. Shared bank accounts, a supplier sharing an employee’s account, dormant suppliers that suddenly need paying. Checked every quarter.
   Ask your team: “When did we last review the supplier file, and what did we find?”
6. A monthly report of bank detail changes. Every change in the month, who requested it, who verified it and how. Reviewed by you.
   Ask your team: “Can you send me this month’s changes by Friday?”
7. Training, with permission to slow down. Fraud works on urgency. Make it clear nobody is criticised for delaying a payment while they check.
   Ask your team: “Has anyone ever felt pressured to pay before checking?”
8. Invoices matched before they’re paid. An invoice for something never ordered or received should never reach a payment run.
   Ask your team: “What share of invoices are matched to a PO and receipt?”

2. Build the controls into the process

Controls that rely on memory fail at month-end, during holidays and when someone new joins the team. The safest controls are built into the workflow.

For your AP team: share our 10-point supplier bank detail fraud checklist.