Prove the Request: Invoice Fraud Prevention

Week two was about who's messaging you. This week is about what they're asking you to do, because even a genuinely-identified sender can carry a request that shouldn't be trusted at face value.

The pattern behind most of this year's costliest fraud is familiar: an email in a thread you recognise, from a supplier you actually use, with an invoice that looks right in every detail except the account number. UK Finance recorded £576.4m lost to authorised push payment fraud last year across more than 248,000 cases, money people were persuaded to send themselves, no hack required. The same pattern scales up to board level: Jaguar Land Rover (£1.9bn, 5,000+ organisations affected) and Marks & Spencer (~£300m operating profit impact) were both ultimately supply-chain and third-party trust failures, not perimeter breaches. And the tell in almost every case is the same one: urgency. A deadline, a threat, a senior name attached, a warning your account closes today, pressure exists to stop you checking, because checking is what breaks the attack.

The rule that doesn't bend: any change of bank details, any request to pay or send something unusual, is verified by voice, on a number you already held, before anything happens, never the number in the email, never a number on the new invoice. If a request makes your stomach drop or your fingers move faster, that's the exact moment to slow down. This is how you ensure invoice fraud prevention.

Read more on our site: Shielding Your Inbox: Building a Robust Response to Business Email Compromise (BEC).

Talk to us: payment-change and supplier-verification processes are a governance problem as much as a training one. Our Guardian GRC360° service covers third-party and supply-chain risk assessment, including DORA/NIS2-aligned supplier due diligence.

Get the guide: the full CAM26 “Prove It” pack is free to download. Get the CAM26 guide.

Source: UK Finance, Annual Fraud Report 2026