Invoice fraud: 31% of UK businesses fall victim

New research from Ivalua has revealed that 31% of businesses were affected by invoice fraud over the last year. Of these, only 39% succeeded in stopping the transactions before the money was paid out.

What is invoice fraud?

Invoice fraud is a type of scam where criminals deceive businesses into paying fake or altered invoices. This kind of fraud can take several forms. For example, fraudsters might create fictitious invoices for non-existent goods or services. They might intercept and alter legitimate invoices so that they are paid into a different bank account. Sometimes they’ll hack into a firm’s email systems to send fake invoices using spoofed email addresses. The latter technique is known as Business Email Compromise (BEC) or ‘CEO fraud’. We explain what this is in more detail in this post.

Why is invoice fraud so common?

According to Ivalua, 64% of UK businesses haven’t automated the processes of matching invoices against orders, contacts and vendor payment information. This makes them particularly vulnerable to invoice fraud, especially for relatively small sums.

Stephen Carter, Ivalua’s Director of Payments Strategy, explains further:

“Invoicing is an area ripe for fraudsters and cybercriminals. They will typically use low-value invoices that look genuine to direct payments into bogus bank accounts. Many of these fake invoices are waved through by employees because they look convincing, and the amounts are often below payment thresholds or lower than the expected value. Organisations also face risks from fraudsters working within the business. This insider threat involves senior employees flipping supplier bank details within payment runs to pocket the cash themselves – this activity is hard to track, and ripe for exploitation.”

How can I protect my business from fraud?

If you want to protect your business from invoice fraud, the best thing you can do is to digitise your payment processes. This will allow you to automate invoice matching against orders and contacts. It will also flag up if there are unexpected changes, such as to a vendor’s bank details.

Other steps you can take include:

• Being wary of requests to change payment details. Even if an email seems genuine, it could be from a hacked account. Always ring a supplier on their landline to confirm that the request is genuine. Do not phone a number included with the request – always check it independently.
• Having a single point of contact. If you pay suppliers regularly, it may be a good idea to have a single point of contact. This will make you less vulnerable to fraudulent requests by people posing as staff members.
• Comparing invoice details. Always compare invoices to previous ones. If any of the details are different, contact the vendor to confirm the changes are accurate.
• Training staff. Make sure all staff who handle invoices are trained to spot invoice fraud and know how to handle it.

Sometimes fraudsters will scour a business’s website for testimonials. This can give them useful information about which firms to impersonate. If you have testimonials online, you may want to consider removing them or, at the very least, ensure you are hyper-vigilant about invoices from the named companies.

What do I do if I’m a victim of an invoice scam?

If you do fall victim to invoice fraud, it’s important to act fast. Get in touch with your bank as soon as possible. They will try and recover the money, but the quicker you tell them the more likely they are to succeed.

You should also report the incident to Action Fraud. This is the police’s national fraud reporting centre. You can contact them on 0300 123 2040 or you can make a report online at actionfraud.police.uk.