Invoice email scams: how can tradespeople protect their business?

21 October 2026

The Trade Hub
Businesses & Employers Hub

If an invoice email asks you to use new bank details, stop and confirm the change by calling a number you already trust, rather than one in the message. That is the government’s advice on payment diversion fraud, and it is a useful rule whether you work alone or share the paperwork with someone else.[1]

A practical routine should cover both directions: the supplier invoices you receive and the invoices your customers receive from you. Agree the checks before the next busy afternoon, when a delivery is waiting and everyone wants an answer.

Recognise the request that needs checking

Invoice fraud can involve a hacked supplier email account or a lookalike domain sending an invoice with changed payment details.[1] The NCSC also describes criminals tailoring emails to an organisation and impersonating familiar contacts.[2] A familiar name or a conversation that seems to fit the job is therefore not enough to settle the question.

Treat a change of payment details as a separate task from checking whether the materials arrived or the work was finished. You might recognise the invoice number and still need to verify where the payment is going. Do not let an urgent delivery deadline replace that check.

Ask whoever handles your inbox to flag changed details rather than quietly updating the supplier record. If you do your own admin, leave the invoice pending until you have time to make the call. Being on a roof, driving or standing at a noisy counter is a reason to pause, not to approve it faster.

Make the call independently

Government guidance says to confirm the old and new account details with a trusted contact using a known telephone number, not one supplied in the message.[1] Before you need it, save a reliable contact for each regular supplier in your own records.

During the call, explain that you received a request to change payment details and need to check it. Do not simply ask whether they sent an invoice: the invoice itself might be expected. Ask the contact to confirm the actual change through their established process.

Record who you spoke to, when you checked and which invoice the check covered. Keep that record with the supplier paperwork, somewhere the person making the payment can find it. If you cannot reach the right person, leave the change unapproved and tell your colleague why. An unanswered call is not confirmation.

Protect the invoices you send too

If you supply customers, government guidance recommends explaining how you will notify them about changes to payment details.[1] Decide on that process, then put a short, consistent explanation on your quotes and invoices. Invite customers to call a number they already hold if an unexpected message changes the instructions.

Make sure whoever answers your business phone knows about the arrangement. A customer checking an email should get a helpful answer, not be pushed back to replying to the same message. If a genuine account change is planned, agree how customers can verify it before the new instructions go out.

Walk through the process with anyone who sends invoices for you. Use a clearly labelled practice example, with no real customer information or usable payment details. Ask where they would find your trusted contact number and what they would do if you were unavailable. Fix the awkward parts before relying on the procedure.

Get help if the email account may be compromised

The NCSC advises reporting suspected business payment fraud to your IT contact as soon as possible. If you have no IT contact and believe an account was compromised, it points to its hacked-account recovery guidance.[2] Use that official route rather than searching for an unfamiliar recovery service in a hurry.

Tell your IT provider what happened, which account was involved and whether anyone opened an attachment or followed a link. Ask them to assess the account and explain what needs checking before you use it normally again. Do not assume that deleting one message has resolved the underlying issue.

If customers may have received altered invoices, arrange a verified way to contact those affected. Keep the message factual: what they should stop doing, how to reach you independently and where they can obtain confirmed instructions. Avoid sharing another customer’s details while trying to explain the incident.

Know what to do if a payment has gone

Contact your bank directly using its official website or telephone number, and alert your IT contact promptly; these are the NCSC’s recommended immediate actions.[2] Its business payment fraud page also links to incident reporting.[2] Do not use contact details from the suspicious email to seek help.

For now, choose one regular supplier and check that you have a trusted telephone number recorded. Then agree who can approve changes and what happens when that person is out on a job. You can find more practical information for people working in the trades in the Trade Hub.