Six checks every business should have against fake invoices
Fake invoices are becoming harder to tell apart from real ones. AI tools now make it easy to copy a supplier’s branding, tone and payment requests. We’ve recently seen attempts reach businesses we work with, some for significant sums.
It’s easy to assume you’d spot a fake. But picture a normal busy day. You’re between meetings, your inbox is full, and an email arrives from a supplier you know, asking for an invoice to be paid today. The logo is right, the tone is right, the amount looks reasonable. In that moment, most of us would pay it.
That’s not carelessness. It’s how these frauds are designed to work. Which is why the answer isn’t asking people to be more careful. It’s having systems and processes that catch what a busy person can’t.
The wider picture backs this up. UK Finance figures show that losses to authorised push payment fraud, where someone is tricked into sending money, rose 19% to £576.4m in 2025.
The good news is that a few simple controls stop most attempts.
- Know the warning signs
Be wary of urgent payment requests, changed bank details, and emails from an address that’s slightly different from usual. - Train your team
Most fraud starts with a person, not a system. Regular cybersecurity training helps staff spot fake requests before they act on them. - Use purchase orders
A purchase order system means every invoice has to match something you actually ordered. - Set up approval workflows and set authority limits
Apps like ApprovalMax or Dext Approvals route invoices to the right people, with defined authority limits on who can sign off what. - If something gets through
Contact your bank straight away. The sooner you act, the better the chance of recovering the money. Then report it to Report Fraud at reportfraud.police.uk or on 0300 123 2040. Report Fraud replaced Action Fraud in December 2025. Let your Factotum team know too, so we can check other payments. - What’s right for you
These controls aren’t one-size-fits-all. A two-person team needs something very different from a business with multiple sites and approvers. The aim is protection that fits how you work without slowing you down. If you’d like to chat about your set up, feel free to get in touch.
