- A total of £50.3 million was stolen from people in the UK through invoice and mandate scams last year. Over 40 Santander UK Corporate & Commercial Banking clients are known to have been targeted in 2024 so far, with a total value attempted of more than £1.3 million.
- London based dental clinic Dentistry100, was targeted by scammers impersonating one of their suppliers, asking to change their details before finalising the payment. When they started to rush and harass the dental business, this “set alarm bells ringing”.
- Santander UK is urging its corporate clients to take extra caution when it comes to paying suppliers and third-parties and reminding people to “never feel rushed into making a payment”.
Payment Redirection Scams: Fraudsters pretend to be a supplier or service provider for your business in order to trick you into changing the bank account payee details. You might receive an email asking you to set up a payment to a new account or to amend the existing payment details. Sometimes these come out of the blue, but normally they appear to come from someone you’re already dealing with, such as a solicitor, supplier, or business contact.
The numbers: According to the latest UK Finance data published in May 2024, a total of £50.3 million was stolen from people in the UK through invoice and mandate scams last year.* The data shows that 80 per cent of all invoice and mandate scam cases reported in 2023 originated via an email. Over 40 Santander UK Corporate & Commercial Banking clients are known to have been targeted in 2024 so far, with a total value attempted of more than £1.3 million.
Chris Ainsley, Head of Fraud Risk Management at Santander UK said: “Payment redirection scams, also known more simply as ‘redirection scams’, are being used by criminals to take millions from UK businesses each year. Even if it is from a third-party or supplier they know very well, businesses should take extra care in checking for legitimate contact details, and make sure to question any requests contacting your existing service provider or supplier with a contact number you’ve used for them before, to check whether it is genuine. Don’t use the contact details in the email or letter as this could lead to you making the checks with the fraudster themselves. If businesses think they have fallen victim to a redirection scam, they should contact their bank as soon as possible.”
Payment redirection scams - how they work:
Scammers can spoof the contact details of an email, asking you to make a payment or change the existing payment details. This can often be posing as an individual or company you know to make the email look genuine, or they could even hack a genuine email address. If you make this payment, the money goes straight to the criminals and never arrives with the genuine person or business. Often there is a sense of urgency in the email to try to make you panic into making the payment quickly and without checking first.
Some examples of the types of payment redirection scams, include receiving new bank details from your solicitor or estate agent to complete on a property acquisition, receiving a fake invoice from a supplier that needs paying before you receive the goods, or perhaps an email from an employee who has asked to change their bank details for their next wages payment.
Case study
Saagar, dentist and business owner at London-based dental firm Dentistry100, was due to make a payment to a long-established supplier, when he received a call from someone he he thought was his supplier, explaining there had been fraudulent activity on their account and that Dentistry100 would need to change the payment details to pay their supplier, urging Saagar to make a payment whilst on the phone. As Saagar was in the middle of a busy day of treating patients, he wrote down the details. He believed the voice on the phone, as they seemed to know all his details and which suppliers they used.
The caller then phoned again and asked him to make the payment sooner which set alarm bells ringing for Saagar as his contact doesn’t usually rush or chase him. Saagar thought on his feet and made the excuse of not being able to hear them and hung up the phone, he then called the company directly requesting the change and at that point, discovered it was fake. Although he had updated the new account details, fortunately, he hadn’t finalised the payment. Once he realised he was the target of a scam, he changed the payment details back to the confirmed, legitimate account details.
Saagar remembered them asking unusual questions such as ‘Do you have enough money in your bank to pay?’, ‘Are you going to make the payment now?’ and ‘Are you going to stay on the phone to make the payment?’, on reflection, he knows these were red flags.
Following the incident, Saagar went straight to the manager of the supplier, to advise them of what had happened. Once made aware, Santander checked with Dentistry100 to see if there had been any suspicious activity on the account. This reassured Saagar, showing not only his account was secure but also how he’d carried out the right steps to prevent the business being a victim of fraud.
Based on the tips provided by Santander, Saagar informed his team they should always call the supplier back to confirm if they have sent this type of email and to never feel rushed into making a payment.
You can watch the full story of Dentistry100’s experience with scammers here.
How to keep your business safe from payment redirection scams:
- Before paying a new bill or changing existing details make sure you confirm the request directly with the company or colleague. Always call on a known and trusted number, one from their direct website or check in person if possible.
- Never respond to requests via the email address it came from or use any contact details in the letter or email.
- Set up a single point of contact for companies you pay regularly.
- Review your payment approval process and use dual authorisation for an extra layer of security.