Invoice fraud is on the increase, and this surge in crime statistics shows no sign of abating. Businesses of all shapes and sizes are at risk of invoice and mandate fraud, and research shows that SMEs are the most affected, but the least protected.
A staggering four in ten small businesses are not aware of the risks posed by invoice fraud, despite it costing UK firms £93million in 2018 according to research.
A survey conducted by UK Finance revealed that although 84% of large businesses were aware of the threat and had incorporated it into their risk management strategy, only 68% of small businesses and just over half of sole traders said the same.
Always be prepared
This lack of preparation and awareness is why UK SMEs are more at risk than ever of becoming victims of invoice fraud.
Managing Director of Economic Crime at UK Finance, Katy Worobec, said: “Invoice fraud could happen to businesses of all sizes. The gangs behind this type of fraud are increasingly sophisticated and will often get hold of details that allow them to pose convincingly as regular suppliers.”
Invoice Fraud Explained
This form of fraud occurs when a business is targeted by often highly sophisticated gangs who pose as a regular supplier or a senior member of staff within the organisation and instruct employees to change contact and payment details, or action a payment reversal. When these changes are actioned, the funds and remittance advice will go to the fraudulent party rather than the real supplier.
Since these gangs are often very well researched and informed, as the fraud has been planned long in advance, they are very able to convincingly impersonate your suppliers, and businesses are usually only alerted to the fraud once a supplier chases for overdue payment and an investigation takes place once it shows that the payment has been made.
There are multiple victims in invoice fraud. Not only is it likely you may end up paying out twice because your original, genuine supplier is still entitled to payment for the invoices, but your supplier may have to face the consequences of being paid late, or even not at all. Recovery of funds depends very much on the police and your bank’s anti-fraud policy.
Many businesses are able to successfully recover funds, but this isn’t always possible and it’s far better to protect yourself from the possibility of invoice fraud rather than try to recover lost funds after the event.
So how can SMEs protect themselves from invoice fraud?
To protect your small business from this type of fraud, the key is awareness. All staff should be briefed and trained on the potential for invoice fraud and how to spot it. There should be procedures in place to verify all mandates and requests for change of payment details or payees.
UK FInance advises: “If someone contacts you asking for a supplier’s bank account details to be changed, always verify with that supplier separately on the phone or in person, using the contact details you have on file.”
Do not use the contact details provided in an email or on a letterhead – these could be misleading. Find contact details from the supplier’s website or from your own historical records.
When transferring payments to a new account, transfer a small sum initially then check the recipient has received the payment correctly before you transfer the balance.
Do not take emails or letters from even very established suppliers at face value. It’s so important to build good relationships with your supplier base so you know their processes, people and structures and therefore any change in tone or personnel could trigger alarm bells.
Talk about this issue within the business community
Cyberattacks, data theft and invoice fraud are happening to small businesses every day, but there seems to be some kind of shame about openly discussing falling victim to this kind of crime. Perhaps it’s fear of appearing foolish, naive or not investing enough in data security that holds people back from talking about their experiences of these crimes.
All this reluctance to share experience and knowledge does help the criminals to take advantage of vulnerabilities, and ignorance. It’s so important to make sure that we are sharing our experiences with our peers in the business world, so we can keep abreast of changes and ideas to increase security and form a united front against would-be attackers.
It’s scary to think that so many business owners are totally unaware of their vulnerabilities and how they could become victims of invoice fraud at any time, and why encouraging discussion and knowledge sharing amongst the SME business community is so important.
Action Fraud is a police body that is available for 24/7 reporting of business fraud, whether as an actual or potential victim or as an insider or witness. If your business has been the victim of a cyber attack or invoice fraud, don’t hesitate to contact this service to share your knowledge and protect us all from the threat of fraudsters.
For more insights and business news for SMEs, family businesses and startups, take a look at our blog archive.