Quick answer: invoice redirection fraud is when a criminal sends an email, apparently from you or a supplier, saying bank details have changed, so the next payment goes to their account. It is far more convincing when it comes from a real email address. In our Yorkshire email security benchmark, 83% of the healthcare and care providers we checked could have their email faked in this way. Two simple defences stop most of it: a call-back rule for any change of bank details, and an enforced DMARC record on your domain.
UK banks and the financial services industry often call this an invoice or mandate scam. It needs no hacking skill, just a believable email at the right moment.
How the fraud works
There are two common versions.
- A fake supplier. Your practice manager receives an email that appears to come from your dental lab, agency or landlord: “We have moved banks, please use these details for this month’s invoice.”
- A fake you. Your patients, families or customers receive an email from your address asking them to pay an invoice, a deposit or a fee top-up into a new account.
Sometimes the criminal has broken into a real mailbox and replies within a genuine email thread, which is very hard to spot. More often they simply send from a forged address. If the domain has no enforced DMARC policy, that forged email has a good chance of landing in the inbox, looking exactly like the real thing.
Why small organisations are a target
- Payments are often handled by one or two busy people, with no second check.
- Patients and families trust email from you and rarely question it.
- Most small organisations’ email domains are not protected. In our benchmark only 17% had DMARC set to block fakes.
- Once money is sent, it is often moved on within hours and is rarely recovered in full.
The government’s Cyber Security Breaches Survey 2025/26 found phishing was by far the most common attack on UK businesses (38% in the last year), and 12% had someone impersonate them in emails or online.
How to stop it: process first
- Never change bank details on the strength of an email. Phone the supplier on a number you already hold, not one in the email, and confirm the change.
- Use two people for changes. One person requests a change to a supplier’s bank details, a second approves it after the call-back.
- Tell patients and families in writing that you will never change bank details by email, and that they should call you on a known number if they receive such a message.
- Use Confirmation of Payee. When your bank tells you the account name does not match, stop and check before paying.
- Be wary of urgency. “Pay today or the service stops” is a classic pressure tactic.
How to stop it: the technical fixes
- Protect your own domain with SPF, DKIM and an enforced DMARC policy, so nobody can send convincing emails as you. Our plain-English DMARC guide explains how.
- Turn on multi-factor authentication for every mailbox, so a stolen password alone cannot open your email. See our guide to MFA for small teams.
- Watch for mailbox rules you did not create, such as rules that forward or hide emails about invoices. They are a common sign that a mailbox has been taken over.
What to do if it happens
- Call your bank immediately using the number on your card or statement. The sooner they know, the better the chance of stopping the payment.
- Report it to Action Fraud.
- Change the passwords on any mailbox that may have been used, and check for unfamiliar forwarding rules.
- Consider whether personal data has been exposed. If so, you may need to report it to the ICO within 72 hours.
FAQs
Our supplier’s email was faked, not ours. Is that our problem?
The process defences still protect you: a call-back on a known number catches a fake supplier email whatever its source. You can also let the supplier know their domain is unprotected.
Would an enforced DMARC record have stopped this?
It stops criminals sending convincing emails from your exact domain. It does not stop lookalike domains or a genuinely compromised mailbox, which is why the call-back rule and MFA matter too.
How do I know if our domain is protected?
Run our free email security check. It takes a few seconds and explains the result in plain English.
How we can help
Unavoidably Secure offers independent audits for dental practices, care providers and regulated small organisations. We check your website, cookies, email security and governance paperwork, and tell you plainly what to fix and who should fix it. We do not certify or guarantee compliance, and nothing in this article is legal advice. Read the full Yorkshire email security benchmark, or head back to the blog.
Could someone send invoices in your name?
Check your domain for free in seconds, or book a free external audit and we will look at your email security in full.
Run the free email checkNeed help with this?
If you need support putting any of this right, contact us today. Tell us briefly what you need and Andrew will reply within one working day. Prefer to talk? Call 07749 941111.