A 2-person payment change check reduces invoice fraud risk by separating supplier verification from approval of new bank details. One person confirms the request through a previously trusted contact; another reviews the evidence before authorising the change. Two approvals of the same email are not independent verification.
The control works only if staff cannot bypass it through urgency, seniority or system permissions. Start with the payment change itself, then connect it to invoice checks, account security and a response procedure.
Key takeaways
- Confirm bank detail changes through a previously established supplier contact, never by replying to the requesting email.
- Require a second person to review the verification evidence before approving the change.
- Keep invoice approval separate from supplier creation and payment release, with named cover for absent staff.
How invoice fraud reaches accounts payable
Invoice fraud uses false, altered or duplicate invoices to obtain money an organisation doesn’t owe. A payment request can divert money for a genuine purchase to a criminal’s account; fraudulent payment requests are payment fraud, not false invoices.
The distinction affects the checks required. A correct purchase order and confirmed delivery don’t establish that replacement bank details belong to the supplier.
These 5 common forms require different checks:
| Fraud type | What accounts payable should examine |
|---|---|
| Fake or fictitious invoices | Whether the supplier, order and purchase are genuine. A fake vendor can be created to submit a false bill. |
| Supplier impersonation | Whether payment instructions came from an independently verified supplier contact. |
| Inflated invoices | Whether quantities, prices and charges match the agreement. |
| Duplicate invoices | Whether the same obligation has already been recorded or paid. A duplicate invoice may be submitted with a changed reference. |
| Internal billing schemes | Whether employees can create suppliers, approve invoices or conceal related-party payments without scrutiny. |
Warning signs include a missing purchase order, emailed bank changes shortly before payment, vague descriptions and amounts just below the approval threshold. Supplier impersonation can involve a message that appears to come from a real supplier. Urgency and secrecy should trigger a pause, but their absence doesn’t establish legitimacy.
A compromised supplier mailbox can carry genuine correspondence alongside fraudulent instructions. Our explanation of business email compromise covers why checking the sender’s address alone leaves a gap.
What the loss figures do and do not show
Older international research illustrates the scale, but it should not be presented as a forecast for a UK business.
A 2022 Forbes article reported more than 34,000 invoice fraud cases across 2,750 surveyed businesses. It also reported average annual losses of $280,000 amongst middle-market companies.
Ardent Partners’ 2024 accounts payable research found that 37% of AP teams experienced increased fraud attacks. Basware also reports that a quarter of finance professionals could not estimate their organisation’s invoice fraud losses.
The examples extend beyond bank-detail changes. Basware describes Detroit Metro Airport paying a contractor $1.5 million for an ice-melting product that was never purchased.
Basware also cites paper cheques accounting for 40% of US business-to-business payments, leaving cheque interception relevant there. That figure is US context, not a UK payment benchmark.
For a UK finance team, the practical question is whether someone can alter a supplier record and influence the next payment without independent scrutiny.
Set up a 2-person payment change check
A fraudulent PDF can retain the correct supplier name, invoice number and amount while changing only the payment destination. This invoice fraud can enable payment fraud by diverting a legitimate payment to an attacker, even when the invoice matches.
1. Confirm the change through a trusted route
The first person places the payment on hold and carries out vendor verification by contacting the supplier using a number recorded during verified onboarding or on an earlier, trusted contract. Don’t use the number in the change request, its attachment or its email signature.
Confirm who requested the change, why it’s needed and the complete replacement account details. Record the contact, number used, time, outcome and evidence.
A familiar voice isn’t sufficient proof. Our guidance on AI-generated CEO voice scams explains why voice instructions also need independently initiated verification.
If the genuine supplier denies requesting the change, retain the original bank record, hold payment and escalate the message.
2. Review the evidence before approving the update
The second person reviews the verification record and compares the confirmed details with the proposed supplier amendment. This separation of duties keeps the verifier and approver as different people. Reopening the same email doesn’t satisfy this requirement.
Record both identities and approval times. Restrict supplier amendments to authorised users and retain the previous details in the audit trail.
Name deputies before holidays or sickness create pressure. If the verifier or approver is unavailable, hold the change rather than allowing self-approval.
Apply this rule regardless of amount. A small initial payment can still establish an attacker-controlled beneficiary for later transfers.
Check the invoice and payment separately
The bank change check does not identify every false bill. Invoice verification must establish that the debt exists, whilst payment approval must establish that the destination and amount are authorised.
Use this check before releasing payment:
| Check | Evidence required | Hold payment when |
|---|---|---|
| Supplier identity | Approved supplier record and verified onboarding. | The supplier is unknown or unexpectedly changed. |
| Purchase authorisation | Invoice matched to the purchase order. | Prices, quantities or authorisation differ. |
| Delivery | Goods receipt or documented service acceptance. | Delivery cannot be confirmed. |
| Duplicate detection | Invoice history and payment records. | References, amounts or billing periods overlap. |
| Payment destination | Approved bank record and change-verification evidence. | Details differ without completed approval. |
Two-way invoice matching compares the invoice with the purchase order. Three-way matching adds the goods receipt. For services, retain documented acceptance. Where purchasing legitimately operates without purchase orders, require an approved exception and equivalent evidence.
A duplicate invoice may have a reformatted or changed reference, so compare the supplier, amount, date and billing period, not just the invoice number.
Separation of duties means the invoice approver cannot also create the supplier or release the payment. Enforce that distinction through permissions, rather than relying only on a written policy.
A small team may need a director or external accountant for independent approval. Shared logins undermine the audit trail.
Reduce the email and identity risks
Payment checks address the instruction reaching finance. Account security addresses how the attacker obtained access or credibility. Neither replaces the other.
Protect mailboxes and monitor account changes
Require multi-factor authentication for email, finance systems and administrative accounts. Review external forwarding, suspicious inbox rules, unusual sign-ins and unexpected permission changes.
Domain authentication and impersonation protection can reduce spoofed messages, but they don’t prove that instructions from a genuine compromised mailbox are legitimate.
Our business email security services support filtering and account protection. Payment verification must remain in place even when messages pass those controls.
Train staff against the process they actually use
Busy AP teams are vulnerable when payment deadlines, supplier queries and approval requests arrive together. An urgent message becomes harder to challenge when challenging it delays a payment run.
Train staff to independently verify payment requests that change supplier payment instructions, even if they appear to come from a director or familiar supplier. Staff should report suspicious changes without seeking permission from the apparent requester. Include genuine-looking supplier messages, altered attachments and requests apparently sent by directors.
Use phishing simulations that improve behaviour to test whether staff pause and verify. Click rates alone don’t show whether the payment procedure works.
If money has already moved
If payment fraud has diverted a payment, contact the bank’s fraud team immediately using a trusted banking number. State that the payment was induced by invoice fraud and request a payment stop or recall, urgent contact with the receiving bank and a case reference.
Provide the amount, payment time, beneficiary details and transaction reference. Do not wait for an internal investigation or police report before calling.
Preserve the original emails with full headers, attachments, invoices, supplier records, approval logs and payment confirmations. Keep a chronology of calls and decisions. Screenshots are useful supplements, but they do not replace original messages and metadata.
Report through Report Fraud’s reporting service in England, Wales and Northern Ireland. In Scotland, contact Police Scotland on 101. Give the bank the reporting reference.
If mailbox compromise is suspected, involve IT immediately to contain access and examine forwarding rules, permissions and sign-in activity. Notify the genuine supplier through a trusted channel. Treat payment recovery and account containment as parallel tasks.
Questions about refunds and legal consequences
Will the bank refund a fraudulent invoice payment?
A refund is not guaranteed. Recovery depends partly on whether the money remains available, whilst reimbursement depends on the payment route, claimant eligibility and applicable rules.
The Payment Systems Regulator’s APP fraud reimbursement protections cover qualifying authorised push payment scams. Microenterprises and certain charities can qualify; larger businesses should not assume that the same mandatory protection applies.
An employee being deceived into approving a transfer also differs from a criminal making an unauthorised payment. Describe what happened accurately when reporting it.
Is creating a fake invoice illegal?
Dishonestly issuing an invoice to obtain a gain or cause loss can constitute fraud by false representation. An administrative mistake or genuine billing dispute does not automatically establish criminal intent.
Under the Fraud Act 2006, applicable in England, Wales and Northern Ireland, fraud can carry a maximum sentence of 10 years’ imprisonment on indictment. Scotland has a separate legal framework.
Put independent verification into the payment process
The useful control is independent evidence, recorded before bank details change. A second approval adds little when both people rely on the same unverified message.
Document the rule as part of wider fraud management controls, assign deputies and enforce permissions that prevent self-approval. Keep invoice matching and payment release checks alongside it.
At Northern Star, our anti-phishing services support staff guidance and safer account use. Speak to our team about aligning email security with your payment verification procedure.
