Payment diversion and business email compromise: how to stop it

This guide is for finance directors, accounts payable teams, CISOs and anyone who approves or releases payments. It explains how payment diversion and business email compromise typically unfold, and sets out the practical finance, email and identity controls that stop money leaving your organisation.

These frauds succeed by exploiting normal business processes, so the strongest defences are process controls that hold even when an email looks completely genuine. Technology reduces the number of fraudulent messages that arrive. A disciplined verification step is what stops the payment.

#What is business email compromise?

Business email compromise is a targeted form of phishing in which criminals impersonate, or take control of, a trusted email account to trick staff into transferring money or revealing sensitive information. The NCSC notes it is also known as payment diversion fraud. Because messages are tailored to individuals, they are harder to spot than mass phishing.

The NCSC's guidance on business email compromise, produced with the National Crime Agency, explains that these attacks target senior executives and budget holders, and that they threaten organisations of all sizes and sectors, including non-profits and government.

#Common patterns

• Supplier bank detail change: a message, apparently from a known supplier, asks you to update their bank details before the next invoice is paid.
• Executive impersonation: a senior leader appears to request an urgent, confidential payment, often while said to be travelling or unavailable.
• Compromised mailbox: criminals gain access to a real account, yours or a supplier's, and insert themselves into an existing email thread.
• Look-alike domains: emails come from a domain that differs from the genuine one by a character or two.

#Why do these frauds work?

They work because they mimic legitimate requests at the right moment, using real names, real invoices and sometimes real email accounts. Urgency, authority and confidentiality are used to rush staff past normal checks. Where a process relies on someone spotting a suspicious email, a well-crafted message can get through, so verification must never depend on the email itself.

This is why the NCSC's phishing guidance recommends assuming that some phishing emails will reach inboxes, and building several layers of defence rather than relying on users alone. It warns that blaming users for clicking on links does not work, because people click for many reasons, including stress and workload.

#Which finance controls stop payment diversion?

The most effective control is verifying every new payee and every change of bank details through a separate channel, using contact details you already hold, never those in the request. NCSC guidance advises verifying important email requests by another method. Combine this with dual approval, Confirmation of Payee checks and a clear rule that urgency never overrides process.

#Payment verification checklist

1. Treat every request to change bank details as high risk, however routine it looks.
2. Call the supplier back on a number from your own records or contract, never one from the email, invoice or letter.
3. Speak to a known contact and confirm both the old and the new account details.
4. Require a second person to approve the change, separate from whoever received the request.
5. Run a Confirmation of Payee check, and stop if the result is a no match or a close match you cannot explain.
6. Record who verified the change, how and when.
7. Apply the same checks to requests from senior leaders, with no exceptions for urgency or seniority.
8. Review supplier master data changes regularly, so an unverified change is caught before the next payment run.

UK Finance explains that Confirmation of Payee checks the payee name you enter against the account holder's name and can return a match, a close match or no match. For business accounts, use the name registered to the bank account, which may differ from the trading name. It advises being wary if you are told to ignore a no-match response.

The NCSC's phishing guidance also suggests telling suppliers and customers what to watch for, for example that your own bank details will not change. Making that commitment in writing helps your partners spot criminals impersonating you.

#Which email and identity controls reduce the risk?

Anti-spoofing controls, strong authentication and mailbox monitoring reduce the risk. DMARC, SPF and DKIM make it harder for criminals to send email that appears to come from your domains. Multi-factor authentication makes mailbox takeover harder. Alerts on suspicious sign-ins and mailbox rule changes help you spot a compromised account before it is used for fraud.

The NCSC's email security and anti-spoofing guidance explains that SPF lets you publish which IP addresses should be trusted to send email for your domain, DKIM adds a cryptographic signature, and DMARC lets you set a policy for how receiving servers should handle email that fails those checks. DMARC also produces reports showing how your domain's email is being handled.

• Publish SPF, DKIM and DMARC records for every domain you own, including domains you do not use for email.
• Start DMARC with a monitoring policy, then move towards marking spoofed email as spam and finally rejecting it, once reports show legitimate senders are covered.
• Enforce multi-factor authentication on every email account, starting with finance and executive mailboxes.
• Alert on new forwarding rules, unusual sign-ins and changes to mailbox permissions.
• Clearly label email from outside the organisation, and watch for look-alike versions of your own and your key suppliers' domains.
• Make it easy for staff to report suspicious messages, and thank them when they do.

#How should staff be trained to spot these frauds?

Train staff on the specific scenarios they will face, such as bank detail changes and urgent executive requests, and make the verification rule the central message. NCSC guidance advises making training realistic, avoiding over-reliance on simulated phishing and building a reporting culture without blame, so people feel able to report even after clicking a link.

• Focus training for finance teams and executive assistants on their real workflows, not generic phishing.
• Make 'verify through a second channel' a rule that everyone follows, including the board.
• Give staff explicit permission to delay a payment while it is checked.
• Reward reporting, not just the absence of clicks.
• Brief new joiners in finance roles on the verification process before they handle payments.

#What should you do if a fraudulent payment has been made?

Contact your bank immediately, using a number you already hold, and ask it to try to stop or recover the payment. Tell your IT and security team quickly so they can check for a compromised mailbox. Then report the fraud to Report Fraud on 0300 123 2040, or to Police Scotland on 101 if you are in Scotland.

1. Call your bank's fraud team straight away with the full payment details.
2. Inform IT and security, who should check for compromised accounts, mailbox rules and other affected email threads.
3. Preserve the emails, headers, invoices and call records, and do not delete anything.
4. Report to Report Fraud online or on 0300 123 2040. Organisations under a live cyber attack should call immediately.
5. Warn the genuine supplier or contact, using details you already hold, as their systems may also be compromised.
6. If you have insurance that may respond, notify your insurer in the way your policy requires.
7. Review how the request got through, and tighten the process.

The NCSC's advice to victims is not to panic, and to tell your IT department quickly, because the earlier they know, the more likely they are to be able to help. It also advises reporting the fraud to your bank.

#What to do next

Next, review your payment change process against the checklist above, confirm it is followed in practice and test it with a realistic scenario. Check DMARC status for all your domains and MFA coverage for finance and executive mailboxes. Then brief the board on the controls in place and the remaining risk, so that leaders follow the same rules.

• Walk through a recent bank detail change and check that every step was followed.
• Run a tabletop exercise with finance using a supplier impersonation scenario.
• Confirm DMARC, SPF and DKIM are in place for every domain you own.
• Confirm MFA is enforced on every finance and executive mailbox.
• Write to key suppliers explaining how you will, and will not, communicate changes to bank details.

#Frequently asked questions