Last updated 10 October 2026.
The email looks routine. A supplier, subcontractor or landlord says their bank details have changed and asks you to pay this month’s invoice to a new account. Sometimes it is genuine. Sometimes it is invoice-redirection fraud: a criminal has read the email thread, or taken over the sender’s mailbox, and the new account is theirs. When the money crosses a border, the checks that catch some of these payments at home may not run at all. This guide explains how the scam works, why international payments are harder to check, how to verify a change with a call-back to a number you already hold, and what to do in the first hour if you have already paid.
This is general information, not legal advice. The figures, rules and dates below come from official sources, as checked on 5 October 2026. Your bank’s own terms and the law where your account is held decide what happens in your case.
This piece sits in the Protect section. If you are the one being paid, it pairs with Getting paid in one country while you live in another and Cleared amount on the invoice: USD ACH without a US bank, which cover the payment details you put on your own invoices.
What the scam looks like
The UK police reporting service, Report Fraud (the old Action Fraud web address now redirects there), calls it mandate fraud, also known as payment diversion fraud or business email compromise. Its description: criminals contact businesses or customers by email, “usually claiming to be from a company that the business or customer has been dealing with”, and “request a payment to be made” or “inform the recipient of a change of bank account details”. It adds that they often create fake email addresses “very similar to genuine” ones and send fake invoices.
UK Finance, the banking trade body, defines an invoice or mandate scam as one where the victim tries to pay a legitimate payee but the criminal convinces them to redirect the payment. It says the fraud “often involves the criminal either intercepting emails or compromising an email account”. That point matters: a request can come from the real address, in a real thread, and still be fake.
How big the problem is
- UK, 2025. UK Finance’s Annual Fraud Report 2026 records GBP 41.3 million lost to invoice and mandate scams across 2,305 cases, the lowest loss total it has reported. 68% of the losses (GBP 28 million) were on business or other non-personal accounts. 48% of losses were returned to victims.
- US, 2025. The FBI’s Internet Crime Complaint Center (IC3) 2025 annual report lists 24,768 business email compromise complaints with reported losses of USD 3,046,598,558.
Why cross-border payments are harder to check
Two name-checking services now cover many domestic payments, and neither covers every international one.
- Confirmation of Payee (UK). Pay.UK describes it as an account name-checking service that helps reduce misdirected payments “for UK domestic payments”.
- Verification of Payee (EU). Article 5c of the EU’s instant payments regulation, Regulation (EU) 2024/886, requires a payer’s provider to check the payee’s name against the account identifier before you authorise a credit transfer, and to warn you if they do not match. Providers in euro-area countries had to comply by 9 October 2025. Providers in EU countries that do not use the euro must comply by 9 July 2027.
Two details in the EU rule are worth knowing. The check must not prevent you from authorising the payment, so a warning is advice, not a block. And your provider has to tell you what ignoring a warning means for its liability and your refund rights.
Neither service is described as covering, for example, a US dollar wire from a UK account to a bank in another country. If a “new bank details” request moves a payment from a domestic transfer to an international one, the name check you are used to seeing may simply not appear. Treat that change itself as a warning sign.
Reimbursement rules follow the same line. In the UK, the Payment Systems Regulator’s mandatory reimbursement for authorised push payment (APP) fraud applies to payments made on or after 7 October 2024 from one UK account to another over Faster Payments or CHAPS. It protects individuals, microenterprises and charities, up to GBP 85,000 per claim, and you should report within 13 months of the payment. UK Finance’s report summarises the scope as “only payments authorised in the UK and received in a UK account”. A payment to an overseas account falls outside it.
The call-back rule
Report Fraud’s advice is to “contact the supplier directly using their official and verifiable contact details”. The IC3 says to “use secondary channels or two-factor authentication to verify requests for changes in account information”. In practice:
- Do not reply to the email or use anything in it. That includes the phone number in the signature, links and any attached letter on headed paper.
- Find a number you already had. Use the contract, an earlier invoice you have already paid successfully, or the organisation’s website, typed in yourself.
- Call, and let them tell you. Ask whether they sent a change request. If they did, ask them to read out the new account details, rather than you reading them out for a yes.
- For large sums, send a small test payment first. Report Fraud suggests sending a small amount and confirming with the intended recipient that it arrived before you send the rest.
- Use the name check where it exists, and read it properly. A no-match or close-match result means stop and call. A match only tells you the account is in that name. It does not tell you the request is genuine.
- Write it down. Who you called, on which number, when, and what they confirmed. If you have staff, Report Fraud recommends that only designated people can change payment details.
Decision table: what the request is telling you
| What you notice | Why it matters | What to do |
|---|---|---|
| Any change of bank details arrives by email | Report Fraud describes this as the standard approach | Call back on a number you already hold before paying anything |
| The sender’s address is almost, but not quite, right | Report Fraud warns of fake addresses “very similar to genuine” ones | Open the full address; do not reply; call back |
| The request comes from the real address, inside a real thread | UK Finance says these frauds often involve intercepted emails or compromised accounts | A genuine-looking email proves nothing; call back anyway |
| The new account is in a different country, currency or name | The payment may move outside domestic name checks and UK reimbursement rules | Treat as high risk; call back and get the details read to you |
| “Urgent”, “pay today”, “I can’t take calls this week” | Pressure is meant to stop you checking | Delay the payment until you have spoken to them |
| The name check says no match or close match | The account may not belong to the payee you named | Stop; do not authorise until you have called back |
| Someone phones you with the new details | You cannot verify an incoming call | Hang up and call the number you already have |
| The amount is large | One mistake costs the whole amount | Test payment first, confirmed by phone |
Worked scenario: Hannah and the new IBAN
Illustrative example. The people, amounts and dates are made up. The rules are quoted from the sources below. Hannah is a freelance video editor who lives in Lisbon. She still has a UK current account and pays a UK colourist, Leo, GBP 2,400 a month by Faster Payments. On Tuesday 6 October 2026 an email arrives from Leo’s usual address, replying in their usual thread. It says his bank is “under review”, gives an IBAN at a bank in another euro-area country, asks her to pay this month’s invoice there, and says he is on a shoot and cannot take calls.
Four rows of the decision table apply: an email change request, a real thread, a new country, and urgency with no calls. Hannah calls the mobile number on the contract they signed in March. Leo has sent nothing. His email account has been taken over. Hannah pays the old account, and Leo changes his password and tells his other clients.
Had Hannah paid, the route would have decided her options:
| How the GBP 2,400 left | UK mandatory reimbursement? | What that means |
|---|---|---|
| From her UK account to the overseas IBAN | No: not a UK-to-UK payment | Recovery depends on how fast her bank can act and on the receiving bank. Her bank’s own policy and any complaint route still apply. |
| From her UK account to a UK account controlled by the fraudster, by Faster Payments | In scope if she qualifies as an individual or microenterprise customer and was not complicit or grossly negligent | Up to GBP 85,000. Firms may apply an excess of up to GBP 100, so the minimum refund would be 2,400 − 100 = GBP 2,300. Report by 6 November 2027 (13 months after 6 October 2026). |
| From her Portuguese account, in euros, to the IBAN | Not the UK scheme | Her Portuguese bank must run Verification of Payee before she authorises. A no-match warning she ignores can affect her refund rights. |
The PSR says you can expect to be reimbursed within 5 business days of making a claim, and that where a firm needs more time to gather information it must still reach an outcome within 35 business days. You will not get your money back if you are found to have been complicit or grossly negligent, which the PSR calls “a high bar”.
If you have already paid: the first hour
Speed matters most. The IC3’s 2025 report says that if you discover a fraudulent transfer, “time is of the essence”. Its Recovery Asset Team, which works with banks to freeze funds, handled 3,900 incidents in 2025 (across all fraud types, not only invoice fraud) and froze USD 679,013,183, a 58% success rate. That included 326 international incidents with USD 171,970,560 frozen.
- Call your bank’s fraud line now. Use the number on your card or the bank’s website. Ask for a recall of the payment. The IC3 advises asking the bank the money left from for a recall or reversal, and for a hold harmless letter or letter of indemnity. Its annual report notes that different banks have different policies.
- Report it to the police. In England, Wales and Northern Ireland, Report Fraud takes reports online or on 0300 123 2040. If you live in Scotland, it says to report via 101. In the US, the IC3 says to file a complaint at ic3.gov regardless of the amount, with full transaction details. Elsewhere, report to your local police and tell your bank you have done so.
- Tell the real supplier, using the number you already have. Their mailbox may be compromised, and other customers may be targeted.
- Keep everything. The email with full headers, the invoice, the payment confirmation and your call notes.
- Watch for a second scam. Report Fraud warns that fraudsters sometimes contact victims again, claiming they can recover the money. Hang up on them.
- Know the next step in the UK. The PSR says that where more than GBP 85,000 is lost and not reimbursed, you can take the case to the Financial Ombudsman Service. The Ombudsman’s award limit for complaints referred to it on or after 1 April 2026, about events on or after 1 April 2019, is GBP 455,000.
When you are the one being paid
Fraudsters can also send your clients a fake “new details” email in your name. A few habits make that harder:
- Keep your receiving details stable, and put them on the invoice itself, not only in an email body.
- Add a line to your invoices or contract: “Our bank details will not change by email alone. If you receive a request to change them, call us on the number in our contract.”
- If you genuinely change accounts, tell clients through a channel they already trust and invite them to call back. If your bank is closing your account, the response plan in Why banks close accounts when you move abroad builds this in.
- If you are moving receipts to a multi-currency payment account, know what that account is and is not. Wise is the rail, not your emergency fund explains the difference between a payment balance and an insured deposit.
If you want one set of receiving details to print on every invoice, a multi-currency payment account is one way to get local account details in several currencies, where your country of residence supports it. Wise is the example we use because its help pages are public. It is a payment and e-money service, not a bank deposit.
Bankrolled may earn a commission if you sign up through this link. It does not change the product or price.
FAQ
Is an email from the supplier’s real address enough to trust a change?
No. UK Finance says these frauds often involve compromised email accounts, so the real address is exactly what a criminal would use. Verify by phone on a number you already had.
Can my bank pull back an international payment?
It can ask. The IC3 advises requesting a recall as soon as you spot the fraud, and its figures show that frozen funds are possible, including internationally. Nothing guarantees it, and the sooner you call, the better the odds.
Does the UK reimbursement scheme cover me if I live abroad?
The scheme is defined by the payment, not by where you live: payments from one UK account to another over Faster Payments or CHAPS, made on or after 7 October 2024, by individuals, microenterprises and charities. Ask your bank how it applies to your account.
What if the name check says it matches?
A match tells you the account is held in that name. It does not tell you that your supplier asked for the change, or that the person asking you to pay is your supplier. Call back anyway when the request came by email.
The supplier says the change is genuine but I am still worried. What now?
Send a small test payment, ask them to confirm by phone that it arrived, then pay the rest. A genuine supplier will usually prefer a short delay to a missing payment.
What this article is not
It is not legal advice and does not cover every country’s rules. It does not cover card payments, cryptocurrency, payroll diversion or the separate rules for business accounts above microenterprise size. Hannah, Leo and their payments are fictional. The loss figures, name-check deadlines, reimbursement limits and reporting numbers are quoted from the official sources below, as checked on 5 October 2026. Check them again before you rely on them.
Sources
- Report Fraud: Mandate fraud. Definition; verify using official contact details; test payments; internal processes; what to do if you have paid; secondary scams; 0300 123 2040. Last checked 5 October 2026.
- Report Fraud: home page. Residents of Scotland to report via 101; the former Action Fraud site redirects here. Last checked 5 October 2026.
- UK Finance: Annual Fraud Report 2026 (published June 2026). Invoice and mandate scams in 2025: GBP 41.3 million, 2,305 cases, 68% (GBP 28 million) on non-personal accounts, 48% returned; definition; comparison of reporting with the mandatory reimbursement scope. Last checked 5 October 2026.
- FBI Internet Crime Complaint Center: 2025 IC3 Annual Report, PDF. 24,768 business email compromise complaints and USD 3,046,598,558 losses; Recovery Asset Team figures; what to do after a fraudulent transfer. Last checked 5 October 2026.
- FBI IC3: Business Email Compromise. Verify changes via secondary channels; request a recall, hold harmless letter or letter of indemnity; file at ic3.gov. Last checked 5 October 2026.
- Pay.UK: Confirmation of Payee. Account name checking for UK domestic payments. Last checked 5 October 2026.
- Regulation (EU) 2024/886 (instant payments), Article 5c. Verification of the payee for credit transfers; warnings do not prevent authorisation; liability; compliance by 9 October 2025 (euro area) and 9 July 2027 (other member states). Last checked 5 October 2026.
- Payment Systems Regulator: APP fraud reimbursement protections. From 7 October 2024; individuals, microenterprises and charities; UK-to-UK Faster Payments and CHAPS; GBP 85,000 limit; GBP 100 optional excess; 13 months; 5 and 35 business days; gross negligence; Financial Ombudsman Service route where more than GBP 85,000 is lost. Last checked 5 October 2026.
- Financial Ombudsman Service: Understanding compensation for financial loss. Award limit GBP 455,000 for complaints referred on or after 1 April 2026 about acts or omissions on or after 1 April 2019. Last checked 5 October 2026.
- Bankrolled: Getting paid in one country while you live in another.
- Bankrolled: Cleared amount on the invoice, USD ACH without a US bank.
- Bankrolled: Wise is the rail, not your emergency fund.
- Bankrolled: Why banks close accounts when you move abroad.
Still got a question? Ask Bankrolled and get a quick answer from our guides.
