Invoice fraud in Basingstoke rarely looks like fraud. It looks like an email from a supplier you pay every month, asking you to send this month’s invoice to a new bank account.
That is the whole trick, and it works because it is ordinary. The fix is not clever software. It is a short process that nobody can skip, and this post sets out six checks you can put in place this week.
Phishing is the most common thing UK businesses face. The government’s Cyber Security Breaches Survey 2025/26 found that 43% of businesses had a breach or attack in the previous 12 months, and that phishing reached 38% of them (reported by ITPro, 1 May 2026). Fake payment requests are one of the ways phishing turns into lost money.
How a fake bank-details email gets through
There are two common routes. In the first, the criminal copies a real supplier’s email style and sends a plausible “we’ve changed banks” message from a lookalike address. One swapped letter in the domain is enough.
In the second, they get into a real mailbox, either yours or your supplier’s. They read the conversation, wait for an invoice, and reply from the genuine account. That is harder to spot because the email really did come from your supplier’s address.
Attackers who take over a mailbox often hide their tracks by creating filter rules that move replies out of sight. A recent case described by a security consultant to The Register (8 October 2026) used exactly that, then sent fake requests for proposal from the stolen account to a second company. The account’s owner saw none of it.
Treat every change of bank details as a security event
Your rule is simple: an email can never change where you pay someone. Not from a new contact, not from your usual one, not marked urgent.
When a supplier says their bank details have changed, you phone them. Use a number you already hold, from an old invoice or your own records, never the number in the email. Ask a question only they would know, such as the last order reference.
Write the rule down and tell everyone who can raise or approve a payment. Fraud works best on the one person who didn’t know the rule existed.
Check where the email really came from
Look at the full sender address, not the display name. Hover over it, or open the message details. Look for a domain that is almost right: a double letter, an extra hyphen, a different ending.
Then look at what the email asks for. Pressure to pay today, a request to keep it quiet, or a new account in a different name from the supplier’s company are all reasons to stop and phone. The NCSC’s guidance on suspicious messages is a useful one-page reminder for your whole team.
Protect the mailboxes behind the payments
If a criminal can log in as someone in your finance team, no amount of careful reading helps. Multi-factor authentication on every email account is the single biggest protection, and phishing-resistant methods such as passkeys or hardware keys are better still.
Check mailbox rules, too. A rule that forwards mail outside the company, or moves messages to a folder nobody opens, is a warning sign. We cover the other basics in our Microsoft 365 security checklist.
Sign-in alerts help. If someone logs in from a country you don’t operate in, or at an hour no one works, you want to hear about it the same day.
Two people for every new payee
Anyone can be fooled on a busy Friday. Build the process so that one person cannot be.
Adding a new supplier, or changing an existing one’s bank details, needs two people: one to make the change and a different one to confirm it by phone. For larger payments, a second approver before the money leaves is worth the extra five minutes.
Keep it light. A short form or a shared checklist beats a policy document nobody opens.
What Basingstoke businesses should watch for
Many Basingstoke firms buy from a lot of suppliers, from the offices and technical firms around Basing View and Chineham Business Park to the distribution and logistics operations on estates such as Viables and Daneshill. The more suppliers and regular payments you have, the more places a fake request can hide.
Two habits help most. Keep one up-to-date list of supplier contact numbers that does not come from email. And make sure whoever covers finance during holidays knows the bank-details rule as well as the person who normally does it.
A five-minute check for your finance team
Print this and put it by the desk. Did the request come by email? Does it change who or where we pay? Have we phoned a number we already held? Has a second person confirmed it? If the answer to the last two is no, the payment waits.
If you think you’ve already paid the wrong account
Phone your bank straight away and tell them it is a suspected fraud. Speed matters: the sooner they know, the better the chance of recalling or freezing the payment.
Then change the passwords and check the mailbox rules on the accounts involved, tell the real supplier, and report it to the police through the national fraud reporting service. Tell your IT support too, so they can check how the criminal got in.
Where we come in
If you want a second pair of eyes on how your email and payment checks fit together, speak to Matt. We’re based in Camberley, around seventeen miles from Basingstoke via the M3, and we look after businesses across Hampshire. You can read more about IT support in Basingstoke, or start with the Microsoft 365 security checklist if you’d rather look first.
Frequently asked questions
What is invoice fraud?
Invoice fraud is when a criminal sends a fake invoice, or a real invoice with changed bank details, so that you pay them instead of your supplier. It usually arrives by email and looks routine.
How do I check a supplier’s change of bank details is genuine?
Phone the supplier on a number you already hold, not the one in the email. Ask a question only they could answer, and have a second person confirm the change before you pay.
Does multi-factor authentication stop invoice fraud?
It stops a large part of it. Multi-factor authentication makes it much harder for a criminal to take over a real mailbox, which is how the most convincing fake invoices are sent.
What should I do if I’ve paid a fraudulent invoice?
Phone your bank immediately and report a suspected fraud so they can try to recall the payment. Then secure the email accounts involved, tell your supplier and report it to the police.
