Preventing payment diversion fraud in practices

Q: Where is a practice most exposed?

Fee invoices. A fraudster in the firm's mailbox, or using a lookalike domain, sends a client a "corrected" invoice with new bank details. Tax payments. A client asks the firm how to pay a tax bill and receives a forged reply with the fraudster's account. HMRC publishes its own bank details on GOV.UK; for Self Assessment, payments go to HMRC Cumbernauld or HMRC Shipley using the 10 digit UTR followed by the letter K. Payroll and bookkeeping. Staff processing payroll or supplier payments for clients receive a request, apparently from the client's director or an employee, to change bank details before the next run. Client money. Any firm that holds and pays out client money is a target for false instructions to release it. HMRC records. ICAEW's Tax Faculty reported that HMRC had found form VAT 484, which can change a business's VAT bank details, being used in fraudulent attempts to obtain VAT repayments. HMRC's agent security guidance also tells agents to check third party software for unexpected activity such as changes to bank details.

Q: What should staff do when a request looks wrong?

Warning signResponse Email asking to change bank detailsDo not reply to it. Phone the client or supplier on a number already on file. Message stresses urgency or confidentialityEscalate to the second approver before any action. Sender address differs by one characterTreat as fraudulent and report it internally. Email claiming to be from HMRCHMRC says genuine emails come only from addresses ending in gov.uk. Forward suspicious ones to phishing@hmrc.gov.uk. Bank warns that the payee name does not matchStop the payment and verify by phone.

Q: What does an attempted fraud look like?

Illustration only. A client receives an email from a partner's genuine address, with the firm's usual invoice for £2,400 attached and a note saying the firm has moved banks. The firm's invoices and engagement letter say bank details never change by email, so the client phones the office number on the engagement letter. The partner has sent nothing. The firm resets the partner's password, removes a forwarding rule the fraudster had set up, checks which clients received messages, warns them, and assesses whether the breach must be reported to the ICO within 72 hours.

Payment diversion fraud happens when a criminal, usually with access to a real mailbox or a convincing lookalike address, persuades someone to send money to a new bank account. In an accountancy practice it runs both ways: clients are told to pay fees or tax into the fraudster’s account, and the firm’s own staff are told to change a client’s, employee’s or supplier’s bank details. The controls that stop it are mostly procedural: confirm every change of bank details by phoning a number you already hold, require two people for payments and changes, and tell clients in writing how your bank details will and will not be communicated.

Tax investigation insurance from £108.75 a year (£9.06 a month).Pays up to £100,000 of your accountant's fees if HMRC opens an enquiry. No excess. Buy online in a few minutes.

See my price in 2 questions How the cover works Accountant? Offer cover to your clients or call 01795 841 310

How does payment diversion fraud work?

ICAEW describes invoice fraud as criminals posing as a regular supplier, usually after hacking into the supplier’s email system or registering a similar domain name, and sending an invoice with new bank details belonging to the scammer. ICAEW notes that hackers often monitor emails for an extended period, so they know when a regular payment is due and can copy the style of genuine messages. The victim authorises the payment themselves, which the FCA calls an authorised push payment (APP) fraud.

Practices are not just bystanders. In its 2026 Practice Assurance monitoring report, ICAEW said incidents at the firms it reviewed included individuals trying to intercept payment instructions, compromised shared mailbox access and access to email accounts through phishing. A practice’s mailbox holds exactly what a fraudster needs: client names, fee amounts, payment dates and the firm’s own invoice templates. The wider security controls are covered in cyber security for accountancy practices; this page focuses on the payment process itself.

Where is a practice most exposed?

Fee invoices. A fraudster in the firm’s mailbox, or using a lookalike domain, sends a client a “corrected” invoice with new bank details.
Tax payments. A client asks the firm how to pay a tax bill and receives a forged reply with the fraudster’s account. HMRC publishes its own bank details on GOV.UK; for Self Assessment, payments go to HMRC Cumbernauld or HMRC Shipley using the 10 digit UTR followed by the letter K.
Payroll and bookkeeping. Staff processing payroll or supplier payments for clients receive a request, apparently from the client’s director or an employee, to change bank details before the next run.
Client money. Any firm that holds and pays out client money is a target for false instructions to release it.
HMRC records. ICAEW’s Tax Faculty reported that HMRC had found form VAT 484, which can change a business’s VAT bank details, being used in fraudulent attempts to obtain VAT repayments. HMRC’s agent security guidance also tells agents to check third party software for unexpected activity such as changes to bank details.

Worried about an HMRC check? Tax investigation insurance pays your accountant’s fees if HMRC opens an enquiry or compliance check. Solar Protect cover pays up to £100,000 with no excess. It never pays tax, interest or penalties.

From £108.75 a year (£9.06 a month) for individuals, £117.57 for sole traders and £207.50 for companies and partnerships, including IPT and the £20 admin fee.

See my price in 2 questions or call 01795 841 310.

★★★★★ Rated 4.9 out of 5 on Trustpilot from over 160 reviews

Which controls stop it?

ICAEW’s 2026 monitoring report lists the measures firms used to prevent payment fraud as staff training, procedures to call suppliers to verify payment details and dual authorisation for payments. ICAEW’s invoice fraud guidance says a change of bank details should always be treated as a red flag requiring checks, including a phone call, and that invoices should be compared with earlier ones for consistency. In practice that means:

Call back on a known number. Verify any new or changed bank details by phoning a number taken from the client file or an earlier contract, never one given in the request.
Two people for every change. One person records a change of payee details; a second checks the evidence of the call back before the first payment is released.
A standing statement to clients. Put in the engagement letter, the client portal and every invoice that the firm’s bank details will not change by email and that clients should phone before paying to any new account. See engagement letters and client onboarding.
Use secure channels for documents with bank details. Send invoices and payment instructions through a portal rather than as open email attachments where possible.
Protect the mailboxes. ICAEW found 88% of the firms it reviewed required two factor or multi factor authentication. Shared mailboxes and former staff accounts need the same protection.
Train staff on the warning signs. Urgency, secrecy, a new account in a different name or country, and a change requested just before a payment run are typical.

The bank’s own checks help but are not a substitute. The FCA has told payment firms to prepare for the expansion of Confirmation of Payee. Whatever checks the bank runs, treat any warning that the account name does not match as a reason to stop.

What should staff do when a request looks wrong?

Warning sign	Response
Email asking to change bank details	Do not reply to it. Phone the client or supplier on a number already on file.
Message stresses urgency or confidentiality	Escalate to the second approver before any action.
Sender address differs by one character	Treat as fraudulent and report it internally.
Email claiming to be from HMRC	HMRC says genuine emails come only from addresses ending in gov.uk. Forward suspicious ones to phishing@hmrc.gov.uk.
Bank warns that the payee name does not match	Stop the payment and verify by phone.

What if money has already been sent?

Speed is critical. The FCA tells victims to contact their bank or payment provider immediately using the contact details on their card or statements, and to report the scam to Report Fraud on 0300 123 2040; in Scotland the report goes to Police Scotland on 101. Keep every email and record of contact.

For Faster Payments and CHAPS transfers made on or after 7 October 2024, the Payment Systems Regulator’s reimbursement rules require the sending firm to reimburse eligible APP fraud victims up to £85,000, usually within 5 working days but up to 35 working days, according to the FCA. ICAEW notes the protection applies to consumers and to small businesses and charities, and the cost is shared equally between the sending and receiving firms. A larger practice should not assume it is covered, and reimbursement can be refused where the victim was grossly negligent.

If a mailbox was compromised, client personal data may well have been exposed. A notifiable personal data breach must be reported to the ICO without undue delay and no later than 72 hours after becoming aware of it; see data protection for accountancy practices. If HMRC agent credentials may be affected, HMRC’s guidance says to report suspicious activity and not to try to correct anything in the HMRC account yourself; see the agent dedicated line page for how HMRC verifies agents. ICAEW also recommends reviewing cyber insurance policies for exclusions and limitations; see cyber insurance explained.

What does an attempted fraud look like?

Illustration only. A client receives an email from a partner’s genuine address, with the firm’s usual invoice for £2,400 attached and a note saying the firm has moved banks. The firm’s invoices and engagement letter say bank details never change by email, so the client phones the office number on the engagement letter. The partner has sent nothing. The firm resets the partner’s password, removes a forwarding rule the fraudster had set up, checks which clients received messages, warns them, and assesses whether the breach must be reported to the ICO within 72 hours.

What mistakes do practices make?

Verifying a change by replying to the same email thread, which may be controlled by the fraudster.
Phoning the number in the suspicious email or its signature block.
Letting one person change payee details and release the payment.
Never telling clients how the firm will communicate bank details, so a forged request looks normal.
Assuming the bank will refund any loss.
Treating a near miss as closed without checking whether the mailbox was compromised.

Solar Protect runs fee protection schemes for accountancy and bookkeeping practices. See how our accountant schemes work or read fee protection schemes for accountants.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 8 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.