Clients trust an email from their accountant. When it says a payment is due, or that bank details have changed, they rarely question it. That trust is exactly what fraudsters want to borrow.
An accountancy practice is exposed to invoice and payment fraud in two directions. Its own payments can be diverted, and its name can be used to divert its clients’ payments. Here’s how it happens and what stops it.
Four ways it happens
- A supplier invoice with new bank details. An email that looks like it’s from a regular supplier says they’ve changed bank. The next payment goes to the fraudster.
- A fake instruction from a partner. A message apparently from a partner asks someone in the practice to make an urgent payment, often just before a weekend or while the partner is known to be away.
- Fake instructions sent to clients “from” the practice. A compromised practice mailbox, or a lookalike domain, is used to tell clients to pay fees or tax to a new account.
- Fake HMRC payment demands. Clients, and sometimes staff, receive convincing messages claiming to be from HMRC. HMRC says its emails about rebates or requests for personal details come “from an email address that ends in hmrc.gov.uk”, and it warns that fraudsters spoof addresses and display names (HMRC).
The first three usually start the same way: a stolen password and a mailbox someone has been quietly reading.
The technical controls
- Multi-factor authentication on every account, with conditional access so a stolen password alone can’t be used from an unknown device or country.
- Alerts on mailbox rules that forward, hide or delete email. These are one of the clearest signs a mailbox has been compromised.
- Impersonation protection that flags messages pretending to be from partners, regular suppliers or the practice itself, including lookalike domains.
- DMARC at enforcement on the practice’s domain, so nobody else can send email that claims to come from your exact address. Our guide to DKIM, DMARC and SPF explains it.
The process controls
These work even when an email gets through:
- Change supplier bank details only after a phone call to a number you already hold, never one from the email requesting the change.
- Two people approve payments above an agreed amount, or any payment to new bank details.
- No urgent payments on email instruction alone, whoever it appears to come from. A real partner won’t mind a quick call to check.
- Tell clients how you will and won’t contact them. Put it in engagement letters and email footers: “We will never ask you to pay to a new account by email. If you get such a message, call us.”
- Remind clients how HMRC contacts them, and that they can forward suspicious HMRC emails to phishing@hmrc.gov.uk.
- Use Confirmation of Payee. UK banks now check whether the account name matches before a payment goes out. Treat a “no match” or “close match” result as a reason to stop and call.
The first hour
If a payment may have gone to the wrong place:
- Call the bank immediately. The faster the bank acts, the better the chance of stopping or recovering the money.
- Report it. Report Fraud replaced Action Fraud in December 2025 and covers Northern Ireland (Report Fraud). The PSNI asks for a call to 101 when the fraud happened within the last 24 hours or police action is needed to stop a loss (PSNI).
- Secure the mailbox without destroying evidence. Reset passwords, revoke sessions and remove rogue rules, but keep the logs and messages.
- Assess whether personal data was exposed. A notifiable breach must be reported to the ICO (now formally the Information Commission) without undue delay, and where feasible within 72 hours (ICO).
- Warn clients if the practice’s name may have been used against them.
- Notify your insurer.
The same attack hits law firms through conveyancing. See payment-redirection fraud in conveyancing for that version.
Related: Cybersecurity for professional firms
Find out where your IT stands
Book a free 15-minute call. If it’s a fit, the next step is our IT Risk and Ownership Review: £295 + VAT, using read-only access to your Microsoft 365, and credited against your first month.
