The Email That Wasn't: A Member's Playbook for Supplier Impersonation and Payment Fraud

The invoice arrives, the logo looks right, the wording is familiar and the bank details are new. A message from the supplier explains that their account has changed and asks for the next payment to go to the new number. It is a scenario played out in UK businesses every week, and it is becoming more convincing. Criminals now have better tools for mimicking tone, copying signatures and timing a message to land just before a payment run.

For associations and their member organisations, the risk is not only financial. A successful impersonation can disrupt a supplier relationship, expose personal data and damage confidence in the finance team. The good news is that the most effective defences are procedural rather than technical. They are also cheap.

Why 2026 demands a second look

Payment fraud has moved on from the clumsy email with mismatched fonts and a generic greeting. A modern impersonation may come from a lookalike domain, a compromised mailbox at the real supplier, or a free webmail account with a display name that matches a known contact. The message may quote a real purchase order, reference a real project and use the same sign-off as the genuine contact. Artificial intelligence has made the language more natural, but it has not changed the underlying trick: create urgency, prevent verification, redirect money.

The UK's reimbursement rules for authorised push payment fraud have improved outcomes for some victims, but they have not removed the need for controls. Prevention remains better than recovery, and recovery is rarely complete.

The red flags that survive a good forgery

No single red flag proves fraud, but a cluster should stop a payment. Watch for a change of bank details on an existing supplier account, especially if it arrives by email rather than through a known portal. Look for a lookalike domain: an extra letter, a hyphen, a different country code, or a reply-to address that does not match the sender. Be wary of urgency, secrecy or a request to bypass the usual approver. A sudden change of contact name, a PDF invoice that cannot be opened properly, or a message that arrives outside normal hours are all worth a second look.

One of the most reliable signals is a request to keep the change quiet. Genuine suppliers do not ask you to avoid telling your finance team.

A verification routine that takes minutes

Build verification into the payment process rather than relying on individual vigilance. A short routine covers most cases.

• Call the supplier on a number you already hold. Do not use the number in the email. Use the contract, the portal or a previous statement.
• Use a second channel. If the request came by email, confirm by phone or through the supplier's established portal. If it came by phone, confirm by email to an address you already hold.
• Apply dual authorisation to bank detail changes. No single person should be able to amend supplier bank details and release a payment.
• Check the name against the account. Confirmation of Payee is a useful prompt, but a match is not proof of identity. Use it alongside a call.
• Hold the first payment to a new account. A short delay gives time for verification and is easier to explain than a loss.
• Keep a supplier contact register. Record the verified phone number and bank details at onboarding, and require a documented process for changes.

Escalation without a blame hunt

The most damaging part of an incident is often the delay. A finance officer who fears blame may spend a day trying to resolve the matter quietly before telling anyone. That is understandable and costly. A written escalation route removes the hesitation: who to tell, how quickly, and what to preserve.

If a suspicious request is received but no payment has been made, preserve the email and headers, notify the finance lead and the supplier through a known channel, and record the attempt. If a payment has already gone, contact the bank immediately. Speed matters more than a complete account of events. Report the incident to Action Fraud, notify the supplier, and consider whether personal data has been compromised. If it has, the association's data protection lead should assess whether an ICO report is required.

A no-blame reporting culture is not softness. It is a control. People report mistakes quickly when they know the first response will be practical rather than punitive.

If a payment has already gone

Act in parallel. Call the bank's fraud line, preserve all correspondence, and tell the supplier so they can check their own systems. Inform your insurer if you hold cyber or crime cover. Brief the leadership team and, where appropriate, members who may be affected. Avoid speculative public statements; stick to confirmed facts and the actions being taken.

After the immediate response, review what happened. Was the verification step skipped, or did it exist but lack authority? Was the supplier contact register out of date? Was dual authorisation applied? The purpose of the review is to close the gap, not to assign blame.

Building the habit into ordinary practice

Fraud prevention works best when it is boring. Add a bank-detail change check to the monthly finance meeting. Include a short reminder in supplier onboarding. Test the escalation route once a year with a tabletop exercise. Keep the contact register current. None of this requires a large budget; it requires a decision that verification is normal.

The invoice may look right. The email may sound like the supplier. That is precisely why the process, not the impression, should decide whether money moves.