Payment Diversion Fraud

Payment diversion fraud is a form of financial fraud in which a payment that is genuinely owed is redirected to a bank account controlled by a criminal. The payer intends to pay a real supplier, landlord, solicitor or employee, but is tricked into sending the money to a different account, usually through a false instruction announcing new bank details, an altered invoice or a compromised email conversation.

The scheme is also called mandate fraud, invoice redirection fraud or change-of-bank-details fraud. It overlaps heavily with business email compromise (BEC) and is a common type of authorized push payment (APP) fraud, because the victim personally authorizes the transfer.

The fraudster first gains information about a real payment relationship. This may come from hacking or spoofing an email account, from data leaked online, or from simple research into a company's suppliers. The criminal then contacts the payer, posing as the payee, at a moment when a payment is due. Common methods include:

• a letter or email announcing that the supplier has changed banks and asking for future payments to go to a new account;
• a genuine invoice intercepted and altered so that only the bank details differ;
• an email sent from a look-alike domain, or from the real but compromised mailbox, during a property purchase or large contract;
• a request to payroll to change an employee's salary account.

The receiving account is usually a mule account opened with stolen or purchased identities. Funds are moved on quickly, often in several hops and sometimes abroad or into crypto, in the layering phase described in the stages of money laundering.

• A change of bank details arriving by email, especially combined with urgency or secrecy.
• A new account in a different name, country or bank from the supplier's usual one.
• Small differences in sender addresses, invoice formatting or reference numbers on a commercial invoice.
• A name that does not match the account, which banks increasingly detect as a beneficiary account mismatch.

The most effective control is procedural: any request to change payment details should be verified by calling the payee on a phone number already held on file, never one provided in the request itself. Many firms also require dual authorization for new or changed beneficiaries, hold first payments to new details, and train staff on social engineering tactics. Payee name-checking services help at the bank level. The United Kingdom introduced Confirmation of Payee, which compares the account name entered by the payer with the name on the receiving account, and the EU Instant Payments Regulation requires a similar verification-of-payee service for euro credit transfers. Broader fraud prevention programs add transaction monitoring for unusual beneficiaries and amounts.

Speed is critical. Once a victim realizes the error, the paying bank can send a payment recall request and ask the receiving bank to freeze any remaining funds. On fast rails such as Faster Payments, money can be moved on within minutes, so recovery is often partial. For international wires, a payment trace using the UETR shows where the money went. Banks that detect mule activity file a suspicious activity report or its local equivalent.

Reimbursement rules differ by jurisdiction and by type of victim. In the United Kingdom, mandatory reimbursement of APP fraud for Faster Payments and CHAPS took effect on 7 October 2024, with costs split between the sending and receiving payment providers and a maximum claim limit, though the rules cover consumers, micro-enterprises and small charities rather than larger companies. In many other countries, including the United States for wire transfers, a business that authorized a payment to a fraudster has limited legal recourse against its bank, and the loss usually falls on whichever party failed to verify the change.