Payment Diversion Fraud: The Controls Every Finance Team Needs

Payment diversion fraud, also called mandate fraud or invoice redirection fraud, is one of the most common and damaging frauds faced by organisations of every size. It is simple: a fraudster persuades an organisation to send a legitimate payment to the wrong bank account. By the time the real supplier asks why they have not been paid, the money has usually been moved on.

Unlike many frauds, it does not require anyone inside the organisation to be dishonest. It exploits normal, busy finance processes and people's natural willingness to help. This article explains how it works and the controls that prevent it.

How the fraud works

The details vary, but most cases follow a familiar pattern.

1. Research. The fraudster learns who your suppliers are, who handles payments and how invoices are sent. Information comes from websites, social media, published contracts or a compromised email account.
2. Impersonation. A message arrives that appears to come from a genuine supplier, saying their bank details have changed. It may come from a lookalike email address, or from the supplier's real email account if it has been compromised.
3. Pressure. The request often coincides with a large payment due, and may stress urgency or confidentiality.
4. Diversion. If the change is processed, the next payment goes to the fraudster's account.
5. Discovery. The real supplier chases payment, sometimes weeks later. Recovery is often difficult.

Variations include fraudsters impersonating senior executives to request urgent payments, or impersonating your organisation to your customers, asking them to pay a new account.

Warning signs

Train finance staff to pause when they see:

• A request to change bank details, especially by email.
• Changes requested shortly before a large payment is due.
• Slight differences in email addresses, domains or signatures.
• Unusual urgency, secrecy or pressure to bypass normal processes.
• A new account in a different name, or in a different country from the supplier.
• Requests from senior figures to make unusual payments outside normal channels.

The controls that work

1. Verify every bank detail change independently

This is the single most important control. Any request to change supplier bank details should be verified by phoning the supplier using contact details already held on file, or from an independent source, never the details given in the request itself.

Ask the supplier to confirm the change, and ideally to confirm some details of the existing account or recent invoices.

2. Separate duties

The person who requests or records a bank detail change should not be the same person who approves it, and neither should be able to release payments alone. A second person should check the verification before the change goes live.

3. Treat first payments to new details as high risk

Flag the first payment to any new or changed bank account for extra review. Some organisations make a small test payment and ask the supplier to confirm receipt before releasing larger sums.

4. Use bank account checks where available

In some countries, banks offer services that check whether the account name matches the account details before a payment is made. Use them, and treat a mismatch as a reason to stop and investigate.

5. Protect email

Many frauds rely on compromised email accounts, yours or your suppliers'. Multi-factor authentication, email filtering, and alerts on suspicious rules such as automatic forwarding all reduce the risk. Close cooperation between finance and security teams helps.

6. Train and test

Finance and procurement staff should know what these frauds look like and feel confident to pause, even when a request appears to come from someone senior. Realistic examples and occasional simulated requests keep awareness fresh.

7. Make it safe to challenge

Fraudsters exploit hierarchy and urgency. Leaders should make clear that staff will always be supported for checking a request, even if it delays a payment or comes from the chief executive.

8. Review supplier records regularly

Periodically check supplier master data for unusual patterns: several suppliers sharing a bank account, suppliers whose bank details match an employee's, or a large number of recent changes.

If it happens

Speed matters. Have a simple plan:

1. Contact your bank immediately and ask them to try to recall or freeze the payment.
2. Report it to the relevant authorities, following local procedures.
3. Preserve evidence, including emails and records of the change.
4. Notify your insurer if you have relevant cover.
5. Check whether other payments or suppliers have been targeted.
6. Review how the fraud succeeded and fix the gap.

Payment fraud is part of a wider picture

Payment diversion is one of many fraud risks. A broader fraud programme includes clear ownership, a fraud risk assessment, preventive and detective controls, investigation, and a culture where people feel able to raise concerns.

Updated October 2026: we have added a Fraud & Financial Crime assessment, covering governance and fraud risk assessment, prevention controls such as bank detail verification, detection and monitoring, investigation, bribery and money laundering, and speak-up culture.

Strong financial controls are the foundation. The Financial Management assessment includes controls and governance alongside budgeting, reporting, cost management and cash flow.

Frequently asked questions

Can we get money back after a payment diversion fraud?

Sometimes, if the bank is contacted quickly and the funds have not yet been moved. Recovery becomes much less likely as time passes, which is why prevention is so important.

Are small organisations targeted?

Yes. Smaller organisations are often targeted precisely because they may have fewer controls and less separation of duties. The core control, independently verifying bank detail changes, costs almost nothing.

Who is responsible if we pay a fraudster?

It depends on the circumstances, contracts and local law, but organisations often bear the loss themselves. Do not assume the bank or supplier will cover it.