The Bank Change That Wasn't: A Builder's Playbook for Payment Diversion Fraud

Payment diversion fraud is not a slick city-bank problem. It turns up in the inbox of a three-van groundworks firm in Doncaster, a fit-out contractor in Bristol, a kitchen installer in Glasgow. The pattern is almost always the same: someone you pay regularly sends an email that looks right, says their bank details have changed, and asks you to update your records before the next payment run. If that email is fake, the money lands in a fraudster's account and your supplier is still owed every penny.

For builders, the risk is especially sharp because so much work runs on trust and speed. You know your merchants, your subcontractors and your regular clients. You are used to sorting things on the phone from a scaffold or a cab. Fraudsters rely on that pace. They want you to do the decent, efficient thing — update the details, pay the invoice — without slowing down for a call-back.

The defence is not complicated, but it does need to be deliberate. Think of it as a site routine: the same way you would not let someone walk onto a job and start work without checking who they are, you should not let a bank-detail change through without a proper check.

Start with a known-good contact list

Most fake payment emails fail at the first hurdle if you already have a verified contact route. Keep a simple list of suppliers and subcontractors with the phone number you normally use for accounts, not a number copied from the latest email. That sounds obvious, but it is exactly where businesses get caught: the fraudster sends an email from a lookalike address, then provides a phone number to 'confirm' the change. You ring it, a friendly voice answers, and the fake details get waved through.

Use a number you already held. If the person answering says they do not know about the change, stop. If the call goes to a mobile that was never on your records, stop. And if the supplier is a sole trader who usually communicates by text, ring them anyway. A thirty-second call is cheaper than a five-figure loss.

Separate the order from the payment

On small sites, one person often prices the job, orders the materials, checks the delivery note and signs off the payment. That is normal, but it is also the ideal setup for payment diversion. A second pair of eyes does not need to be a finance department. It can be the office manager, a partner, or a trusted site supervisor who checks bank-detail changes against the known-good list.

Make it a hard rule: no change to bank details goes live on the same day it arrives. A short hold — even until the next morning — gives you time to ring the supplier and lets any urgency in the email cool off. Genuine suppliers will understand. Fraudsters will push. That push is a warning sign in itself.

Treat invoices as documents to check, not just pay

Cloned invoices are getting better. The logo, the layout, the payment terms and even the reference number can look right. Look for the small tells: a change to the bank details, a new email domain that is almost but not quite correct, a remittance address that has moved, or a sudden request to pay by Faster Payments rather than the usual method. If an invoice arrives as a PDF with a covering email that says 'updated bank details attached', treat the whole thing as unverified until you have spoken to the supplier.

It also helps to brief the people who open the post and the inbox. A site manager who forwards a supplier email to the office with the words 'can you pay this today' is not being careless; they are being efficient. Give them a simple instruction: if the bank details have changed, flag it and do not pay it until the office has called the supplier on a known number.

Lock down the site-office inbox

Many payment frauds start with a compromised email account. If a fraudster gets into a site office inbox, they can read genuine invoices, learn your payment patterns, and send convincing follow-ups from the real address. That is why email security is a payment control, not an IT nicety.

Use strong passwords and two-factor authentication on business email accounts. Keep the accounts used for ordering and payments separate where possible. Remove access for people who have left, including agency staff and former subcontractors. And if an email account is compromised, treat every bank-detail change sent from it as suspect until you have confirmed it by phone.

The first hour after a fraudulent transfer

If money has gone to the wrong account, speed matters more than blame. Ring your bank's fraud line immediately and ask them to recall the payment. Have the transaction details ready: date, amount, recipient name, sort code, account number and the reference. Ask the bank to record it as an authorised push payment fraud. In the UK, report it to Action Fraud as well, and keep the reference number.

Preserve the evidence. Do not delete the email, invoice or text. Take screenshots, save headers if you can, and note the phone numbers and times involved. Tell your insurer if you have cyber or crime cover, and tell your genuine supplier what has happened so they can protect their own accounts. Then change the passwords on any affected email accounts and check for forwarding rules or mailbox changes you did not set up.

Do not rely on the idea that the bank will simply refund you. Business banking protections are not the same as consumer protections, and recovery depends on how quickly the payment is flagged and where the money has gone. The first hour is not the time to write a long email; it is the time to pick up the phone.

Make the routine stick

The businesses that avoid this fraud are not the ones with the most complicated finance systems. They are the ones where everyone knows the rule: bank-detail changes get verified by phone on a number we already held, and nobody pays a changed invoice on the day it arrives. Put that in your site induction, add it to your office checklist, and mention it at the next toolbox talk. Fraud prevention is a compliance habit like any other — a little boring, a little repetitive, and worth every minute when it stops a payment landing in the wrong account.