How to prevent invoice fraud in accounts payable: six key controls

Invoice fraud is when a business is tricked into paying a fake, altered, or duplicate invoice, or into sending a genuine payment to the wrong bank account. You prevent it by putting a control at each point an invoice or payment request enters accounts payable (AP). Spotting fake invoices covers only one of those points.

UK Finance recorded 2,305 invoice and mandate fraud cases in 2025, and victims lost £41.3m, with only 48% returned. Those are only the cases reported to banks, so the real cost is higher.

Because the money is so hard to get back, prevention matters more than recovery. This guide maps out six points where invoice fraud enters AP, the control that closes each one, and how a finance system enforces it. At the end, there’s a red-flag checklist for your AP team and the questions you should ask AP software vendors.

Types of invoice fraud and where each one enters accounts payable

Invoice fraud is any scheme that gets a business to pay money it doesn’t owe, or to pay what it does owe into an account a fraudster controls. UK finance teams call it invoice fraud or mandate fraud. US sources call it accounts payable fraud. Whatever term you use, it’s the same problem.

Where the fraud starts decides which control stops it. External fraud arrives through a spoof email or a hacked supplier mailbox, so verification closes it. Internal fraud starts inside the business, often with a supplier’s help, so separating duties closes it. The table below shows the most common types and where each one enters AP.

Type	What happens	Where it enters AP
Mandate fraud	An email posing as a supplier asks you to change their bank details	Supplier details
Fictitious supplier	A fake company is set up as a supplier, often by an insider	Supplier details
Fake or false invoice	An invoice for goods or services that were never supplied	Invoice intake
Altered invoice	A genuine invoice with changed bank details, often from a hacked supplier mailbox	Invoice intake
Duplicate invoice	The same invoice paid twice. Often not malicious: a supplier chases payment and resends it, sometimes with a new number	Invoice intake
Inflated pricing or kickbacks	An insider and a supplier agree on prices above the contract	Purchase request and PO
Split invoices	One bill split in two to stay under an approval limit	Approval and payment run
CEO fraud	An email posing as an executive demands an urgent payment	Requests outside the process
Overpayment refund scam	A ‘supplier’ asks for a refund to a new account	After payment

Employee expense claims carry their own risks, which our business expense fraud guide covers.

How to prevent invoice fraud at each point it enters accounts payable

Each fraud entry point below tracks the same pattern.

• How the fraud works
• The control that closes it
• How a system enforces it

Purchase request and PO: invoices for things nobody ordered

How it works: a supplier bills for goods nobody ordered and counts on the invoice looking routine. Or an insider agrees a price above contract with a supplier and shares the difference.

The control:

• No payment allowed without an approved purchase request or purchase order (PO)
• Match every invoice to its PO and delivery note before approval
• Check unit prices against the contract, not last month’s invoice

How a system enforces it: purchase requests route for approval before a PO is raised, and two- and three-way matching runs on every invoice linked to a PO. Payhawk matches more than €100m of supplier invoices against POs and delivery notes each month. For the wider framework, see our guide to accounts payable internal controls.

As Tim Green, Head of Finance Transformation at Aventum Group, puts it:

The PO features have given us a lot more visibility and control. Now, with the approval workflows in PO, we can embed the controls in-house and give our procurement manager complete control.

Supplier details: fictitious suppliers and mandate fraud

The supplier master file is the most valuable target in AP. One edit to a bank account redirects every future payment to that supplier.

How it works: fictitious supplier fraud is when someone, often on the inside, sets up a fake company as a supplier so its invoices pass as normal. Mandate fraud is when a fraudster posing as a real supplier says ‘our bank details have changed’, so the next payment lands in the fraudster’s account.

The control:

• Make sure you verify every new supplier before the first payment. Verify using Companies House registration, VAT number, trading address, and the name on the bank account
• Never act on a bank-detail change using contact details from the request. Get Safe Online advises verifying ‘directly using established contact details’, so call the number already on file
• Limit who can edit supplier bank details to named roles
• Require a second approver for every bank-detail change
• Alert on every change and warn before the first payment to a new account

How a system enforces it:

• Confirmation of Payee (CoP) checks the name on the account when GBP supplier details are added. Then also when GBP payments are confirmed and authorised. A partial match, no match, or ‘cannot verify’ result needs someone to explicitly confirm before they continue. If the account doesn’t exist, the payment can’t go ahead
• For EUR suppliers, Verification of Payee (VoP) runs the same check in the EEA
• A supplier bank detail change log records who changed what, when, and any note they added. Unpaid bills then show a notice that the payment details have changed, so you choose whether to apply the update
• Four-eyes approval, once enabled, holds a supplier bank-detail change, including adding new suppliers, until another person approves it, and payments to that supplier pause in the meantime
• A first-payment warning appears before you pay bank details that have never been paid, on a new supplier or after a change

Invoice intake: fake, altered, and duplicate invoices

How it works: fake invoice fraud is an invoice for something never delivered. This is usually from an unfamiliar sender. An altered invoice is a real one but with new bank details, and it's usually sent after a supplier’s mailbox is already compromised. A duplicate invoice is the same bill submitted twice, sometimes with a new number. Often there’s no fraud behind it: a supplier chases an unpaid invoice and sends it again. Either way, it’s AP’s job not to pay it twice.

The control:

• Bank details printed on an invoice never override the verified supplier record
• Check for duplicates on supplier, amount, date, and invoice number together, not on invoice number alone
• Send invoices with no PO and no supplier history to manual review

How a system enforces it: duplicate detection flags repeat invoices by amount, supplier, date, and document number. Invoices sent to the Payhawk Mailbox are checked for duplicates on arrival, and duplicates are removed before anyone reviews them. Matching then ties each invoice to its PO and delivery note.

As Shuhul Koul, Financial Controller at Arc and Naya, puts it:

Before, we just paid whatever came in. […] Payhawk builds in those checks, and that’s a game-changer.

Approval and payment run: segregation of duties, split invoices, and insider risk

How it works: an approver sees only an amount and signs it off. A bill is split in two to stay under an approval limit. One person changes a supplier’s bank details, confirms the payment, and authorises it. A payment file is edited between export and upload to the bank.

The control:

• Always route approvals by amount and show approvers the PO and supplier history alongside the invoice
• Separate confirming payment details from authorising the payment (segregation of duties), so a second person always signs off (the four-eyes principle)
• Pay through the system, not from an exported file, so nobody can edit the payment file between export and upload to the bank

The second control has a name: segregation of duties (SoD). In payments, it means no single person can set up, approve and pay the same transaction. In a small team where a step can’t be split, add a compensating control, such as an independent review of the payment run or of bank-detail changes.

How a system enforces it: approval workflows route bills by amount threshold. In Payhawk, segregation of duties for bill payments is on by default: the person who confirms payment details can’t authorise that payment.

Teams confirm and authorise supplier payments in the platform, and the authoriser can approve the final step in the web app or on their phone. UK and EEA transfers run from the Payhawk currency account, so there’s no payment file to edit.

Requests outside the process: CEO fraud, business email compromise and urgent payment emails

How it works: CEO fraud is where an email posing as a senior executive asks for an urgent transfer, often asking them to keep it quiet. A different version can have a ‘supplier’ asking to be paid today to a new account. CEO fraud is rarer than mandate fraud, but each case costs more on average. UK Finance recorded 197 CEO fraud cases in 2025 with £5.6m lost, and only 20% returned to victims.

Business email compromise (BEC) goes a step further. The fraudster gets into a real mailbox, so the request comes from a genuine address, often in the middle of an existing thread. Inside a finance or supplier mailbox, they can also intercept invoices and resend them with new bank details, or approve a request by replying to it.

The control:

• Nothing is paid unless the supplier is set up in the system and the invoice is approved
• Treat urgency and secrecy as reasons to slow down
• Verify by phone on a number you already hold, never by replying to the email
• Never approve a payment or a bank-detail change by email, even from a colleague’s real address. Approvals happen in the system, where each person signs in with their own login

How a system enforces it: the workflow is the control, so when every payable has to go through approved suppliers and the approval chain, an urgent email can’t fast-track a transfer; it joins the queue like any other payment request. Because approvals and bank-detail changes happen in Payhawk rather than in an inbox, a hijacked mailbox can’t approve a payment on its own: the attacker would also need a Payhawk login protected by two-factor authentication.

After payment: refund scams and reconciliation

How it works: an overpayment refund scam is when a ‘supplier’ claims you’ve paid twice and asks for the difference back to a new account. Fraud that slipped through earlier can stay hidden until someone compares the records.

The control:

• Treat any refund to a new account as a bank-detail change, with the same callback and approval
• Reconcile supplier statements against the ledger every month
• Review payments to new suppliers at month-end

How a system enforces it: payments sync to the ledger for invoice reconciliation, and every action sits in a full audit trail you can check against supplier statements.

Lock down system access

Every control above depends on who can log in and what they can change. Require two-factor authentication (2FA), give each person a role that reaches only the steps they own, and keep an audit trail with before-and-after values on every change.

Payhawk logs every supplier change with who made it and when, shows old and new bank details on every change that needs approval, and emails admins when supplier bank details change.

Fraudsters who can’t get past the controls try to change them instead: editing a payment workflow to remove an approval step or switch a control off, inviting or promoting a second admin so one person can satisfy four-eyes approval, or using a bulk import to quietly change supplier bank details or give employees admin rights.
Payhawk extends four-eyes approval to these changes too. Any edit to the approve, review, confirm details and authorise steps of a payment workflow, any invitation or promotion into a privileged role, and any import that changes supplier bank details or assigns a privileged role will need a second person to approve it.

Invoice fraud red flags: a checklist for AP teams

Below are some key signs that an invoice or payment request needs a second check before it’s paid.

Red flag	Why it matters
Invoice bank details differ from the supplier record	Classic sign of an altered invoice
Bank-detail change requested by email	The core move in mandate fraud
Pressure to pay today, or ‘keep it confidential’	Urgency is how CEO fraud skips checks
New supplier with a large first invoice	Fictitious suppliers often bill big, early
Invoice number out of sequence or already used	Points to a duplicate or a fake
Amounts just under an approval limit, or several from one supplier in a short period	Classic split-invoice pattern
No PO, or a PO raised after the invoice	Someone might never have approved the purchase
Sender domain one character off the real one	A lookalike domain impersonating a supplier
Supplier address or bank account matches an employee’s	Possible insider fraud
Layout, logo, or VAT number differs from earlier invoices	Possible fake or altered invoice
Domestic supplier asks to be paid to an overseas or personal account	A common diversion route

A red flag is a reason to verify through a known channel; it’s not proof of fraud. If money has already gone, call your bank immediately and report it.

What to look for in AP software to prevent invoice fraud

The controls above only work if they run in one place, rather than across inboxes, spreadsheets and bank portals. That’s harder than it sounds: in research Payhawk ran with Raconteur, 63% of CFOs and 70% of CIOs said centralising control and visibility was ‘extremely challenging’.

The right AP software takes most of that work off your team. Use these questions to test how well a vendor prevents invoice fraud:

Question	Why it matters	What a strong answer looks like
Does it check the payee name against the account?	Stops payments to a fraudster’s account	Confirmation of Payee (CoP) for GBP and Verification of Payee (VoP) for EUR, with explicit confirmation on any mismatch
Who can edit supplier bank details, and does a change need a second approver?	Closes the main mandate fraud route	Named roles only, and a second approval before any change takes effect
Are bank-detail changes alerted and logged?	Lets you trace every change	A log of who, when, and why
Is separation between confirming and authorising enforced by the system?	Policy alone depends on memory	Enforced in the workflow, on by default
Which fields does duplicate detection check?	Number-only checks miss renumbered duplicates	Supplier, amount, date, and document number
Does it match invoices to POs and delivery notes?	Catches invoices for things nobody ordered	Two- and three-way matching with discrepancies flagged
Does it warn before the first payment to a new payee?	First payments carry the most risk	An in-flow warning before release
Are payments executed in the platform or exported as a file?	Exported files can be edited	Payments executed in the platform
Is 2FA required, and are roles granular?	Controls rely on access	2FA at login and role-based permissions
Can you export the audit trail for an auditor?	Evidence for audit and investigation	A full, exportable trail of actions and changes

A platform like Payhawk covers these inside one workflow, from purchase request to payment. See how controls work together in our invoice fraud prevention overview, or explore our accounts payable software.

Prevent invoice fraud by closing every entry point

Invoice fraud enters accounts payable at six points, so one control can only cover part of the risk. The biggest opportunities sit in the gaps between steps: off-process requests, bank-detail changes, and refunds.

Controls work best when the system enforces them, so they hold up on the busiest payment day without anyone having to remember.

If you’d like to see these controls in your AP process, book a demo.