Tighten Payment Controls After a Fraud

Act on payments first, questions later

If your business has just discovered a fraud, whether a fake invoice or a compromised email, the first job is to stop any further payments. Freeze any pending transfer linked to the suspicious instruction before anything else.

Call your bank’s fraud line directly, using a number you already have on file, not one from the suspicious email. Ask whether the payment can be recalled or held, and get a reference number for the call.

Put dual approval on bank detail changes

A single person should never be able to change a supplier’s bank account details and release a payment on the same day. Require a second person to check and approve any change to payment details.

This single control stops most of these frauds before money leaves the account. It costs little to set up and can be applied from today.

Verify by phone, never by email

When a supplier or director asks to change bank details or approve an urgent payment, call them back on a number you already have, never one given in the message. Scammers often supply a new “correct” number in the same email.

This callback check takes a few minutes and catches most fake instructions. Treat any request that pressures you to skip it as a warning sign in itself.

Slow down new or changed supplier accounts

Put a short hold, even a day or two, on payments to a new supplier account or one that has just changed its bank details. Use that time to confirm the change through a second channel.

Urgency is the scammer’s main tool. A genuine supplier will accept a short delay while you confirm the details are real.

Review who can move money and how

Limit which staff can initiate or approve wire transfers, and review this list regularly as people join or leave the company. Look at your email and domain security too, since many of these frauds start with a compromised or lookalike email account.

What to do next

Report the fraud to the police and, if the transfer was recent, call the National Scam Response Centre (NSRC) on 997 as soon as possible. Read more about business email compromise and how a civil claim against a scammer can sometimes trace or hold funds.

Keep every email, invoice, and bank confirmation related to the incident. If the loss is significant, or the bank disputes responsibility, a first legal assessment can help you see whether formal letters or court steps are worth pursuing.

You can also check under whether legal action is likely to be worth it for a case like yours. You are not required to commit to anything before asking questions.