Close

Updated Cookies Policy - you'll see this message only once.

Barclays uses cookies on this website. They help us to know a little bit about you and how you use our website, which improves the browsing experience and marketing - both for you and for others. They are stored locally on your computer or mobile device. To accept cookies continue browsing as normal. Or go to the cookie policy for more information and preferences. If you clear your browser history to disable or delete all cookies, your cookie preferences will automatically be reset to accept all cookies. Please go to the cookies policy to make any changes.

Invoice fraud can be devastating. It is important that employees are able to spot the signs.

DCI Andrew Gould, Metropolitan Police

Invoice fraud: protect your business

Invoice fraud is perhaps one of the simplest forms of fraud, but with the potential to cost businesses millions of pounds if staff are not vigilant. And at a time when the UK’s banks are carrying out ring-fencing, businesses face an increased risk of invoice fraud.

Barclays is aware of incidents where companies have paid out sums in excess of £1 million to fraudsters, in the belief they were paying a genuine supplier. Often the error is only spotted when the genuine supplier chases a payment that they haven’t received – by then it can be too late and the fraudsters have withdrawn or moved the money.

How does it happen?

Fraudsters rely on the fact that people who work in finance are busy people, and will exploit this in the hope that you won’t notice details that aren’t quite right. A fraudster will send a change of bank details request by post, email, or even by phone. They can also intercept genuine emails containing invoices and change the bank details or send an invoice including new bank details.

They will often have done their research – for instance having checked a supplier’s website and seen that you are one of the supplier’s clients – meaning the request won’t be completely unexpected. Once you’ve made the requested change and paid the first invoice, you can expect that they will submit multiple invoices until the fraud has been discovered.

“Invoice fraud can be devastating,” explains DCI Andrew Gould – a detective on the Metropolitan Police’s anti-fraud Falcon (fraud and linked crime online) taskforce. “It is important that employees are able to spot the signs of an attempt and that a strict policy is in place when making changes to payment details. This should require checking the changes with the company concerned by contacting them directly through existing contacts, as well as require a manager to check and sign off the changes.”

Checklist to protect yourself from invoice fraud
Requests for changes to a supplier’s bank details should always be verified using details previously held on file.
When an invoice has been paid, inform the supplier, including the account the payment was made to. Again, use details previously held on file.
If you are suspicious about a request made by phone, ask the caller if you can call them back. Fraudsters will attempt to pressure you into making mistakes – take the pressure off by taking control of the situation.
Consider removing information such as testimonials from your own or your suppliers’ websites or social media channels that could lead fraudsters to knowing who your suppliers are.
Look carefully at every invoice and compare it to previous invoices received that you know to be genuine – particularly the bank account details
Check the company logo – you will often find blurry logos on fake invoices
Check the email address that you’ve received an invoice from carefully – fraudsters will use addresses that are similar to a genuine address – for instance ending in .org instead of .com
Apply the same principles to requests from within your own organisation

Source: Financial Fraud Action UK

Beware of internal invoice fraud

Although less common than external fraudsters targeting businesses, there have been a number of cases where staff in responsible positions have knowingly processed false invoices for personal gain. In order to minimise the chance of being a victim of insider fraud, you should have processes that involve more than one person being required to approve and pay invoices. For instance, if your business is procuring IT equipment, you might insist that the IT manager responsible approves the invoice for work carried out, while someone in the finance department is responsible for processing the payment.

A case study

Jane Doe Consulting is a fast-growing consultancy business. Their success has been recognised with a string of high-profile awards, which have received a great deal of press and social media attention.

The company’s rapid expansion means that they have outgrown their current offices. Joe Bloggs Architects Ltd has just announced that they have been chosen to design Jane Doe Consultancy’s new city centre office.

Jane Doe Consulting’s treasurer receives a letter that appears to be from the architects’ finance department informing them that due to the scale of this project, they have set up a new account to handle payments relating directly to it. The letter is signed by the same person as previous correspondence, and is laid out in a similar way, apart from a blurred logo. The treasurer makes the change and arranges payment for the first invoice which was also included in the letter, for £100,000.

The following week, Joe Bloggs Architects Ltd’s finance assistant calls Jane Doe Consultancy’s treasurer to explain that they will shortly be issuing the first invoice for recently completed work. The treasurer realises their mistake, and contacts their bank immediately. Unfortunately, all but £12,000 has already been moved from the account leaving Jane Doe Consultancy with a loss of £88,000.

The treasurer should have called the supplier on previously verified details to check if the request was genuine.

What to do if you suspect you’ve received a suspicious invoice

  • If you have paid the invoice, contact us immediately. Our team will try to recover the money from the fraudster’s bank account. The quicker you alert your bank, the greater the chance of recovering the funds.
  • Report it to ActionFraud – the police’s national fraud and cyber crime reporting centre. Even if you’ve not suffered any financial loss, this will allow the police to analyse trends and help them to prevent fraudsters exploiting other companies. You can file a report via their website at www.actionfraud.police.uk^ (opens in a new window) 
  • If you receive a suspicious email that appears to be from Barclays, please forward it to internetsecurity@barclays.co.uk and then delete it from your email account immediately.

Learn more about how to protect your business from fraud in our fraud smart centre.

    Contact Us

    If you have any questions or concerns about fraud contact us:

    0330 156 0155 / 0800 056 4890*