A supplier’s email can look genuine. The bank details may have changed, and the invoice may be due today.
If you approve the transfer, one hard question follows: did a criminal hack your business, or did you authorise payment to the wrong account?
Cyber insurance can often help, but only if the policy names funds transfer fraud or social engineering. A standard cyber policy may not repay an authorised payment after a fake invoice.
When cyber cover is worth it for tradespeople
Cyber cover is most useful when an invoice scam could take money you cannot comfortably replace. Think of it as cover for a costly wrong turn in your payment process.
A policy only helps if its fraud wording matches the loss. The policy name alone does not decide that.
Use the sender-and-recipient test
Ask who has lost the money. If your firm pays a fake supplier invoice, your firm has a direct financial loss.
If a client pays a false invoice that appears to come from you, the client loses money first. You may still face a dispute or claim for your role.
The same scam can create different insurance needs.
A fast cover decision
| Your situation | Cover to seek | Check before relying on it |
|---|
| You pay a false supplier invoice | Social engineering or funds transfer fraud | Authorised payments are included |
| A client pays an altered invoice bearing your name | Cyber liability and possibly professional indemnity | Your liability to clients is covered |
| A worker diverts a payment internally | Crime or fidelity cover | Employee dishonesty is included |
The cover must match who paid and who lost.
How invoice scams reach a busy site team
Invoice fraud usually abuses an existing business relationship. It is not usually a random cold email.
Criminals often copy details from genuine jobs. That makes the request feel normal during a busy payment run.
The altered invoice route
An altered invoice can look completely real. The job name, price, purchase order and sender may all be correct.
Only the sort code and account number may have changed. That small change sends your money to the criminal.
A familiar invoice can still contain false bank details.
The false bank-change request
Use a number already saved in your phone. You can also use one on an earlier genuine invoice.
A supplier’s established website can also provide a safe number. Do not use the number in the email chain.
A second person should confirm changes above a limit you set. For a small firm, this might be between £1,000 and £5,000.
The most frequent error is letting one busy person do every step. They receive the email, change bank details and release payment.
That process is fast, but it removes the check that may stop a loss.
The National Cyber Security Centre gives small firms practical account-security and reporting guidance. See the official NCSC website.
Multi-factor authentication, or MFA, adds a second identity check, such as a phone code. It is like needing both a key and PIN to enter.
Many scams start with phishing or business email compromise, called BEC. A criminal steals a supplier’s or contractor’s email password.
They then reply inside a genuine email thread. That is why the message may show the right job reference and contact name.
It may even include earlier messages. It can still be a bank-detail change scam.
MFA makes a stolen password less useful to a criminal. It should sit beside quick password resets and mailbox checks.
Check mailbox forwarding rules for unknown changes. Also look for unfamiliar login activity.
Effective prevention needs supplier bank checks and payment checks. Use a number found independently, not one in the email chain.
Which insurance may respond to the loss
The insurance label does not decide the claim by itself. The wording, limits and exclusions decide what may be paid.
An authorised bank transfer usually needs express social engineering or funds transfer fraud cover, not just generic cyber cover. Social engineering means tricking a real person into acting.
In this case, the trick is approving payment. The criminal may never need to break into your own systems.
You pay a false supplier invoice
Call your bank first because it may try to recall or freeze funds. Tell it you suspect authorised push payment fraud.
Give the payment reference straight away. Do not wait until you have collected every email.
Speed can affect whether funds remain in the receiving account.
A client pays a false invoice
A client may ask why an altered invoice used your branding. They may say your email or payment process enabled their loss.
Your liability cover may pay for legal advice, notice support and investigation. Professional indemnity may also matter if your service failure caused the loss.
A subcontractor appears to change accounts
A hacked subcontractor account can look like a simple fake email. The two situations can be hard to tell apart at first.
If your employee changes details and steals funds, crime or fidelity insurance may fit better. That cover addresses employee dishonesty.
Cyber cover may not be the right answer here.
The first 15 minutes after suspected invoice fraud
0 to 5 mins
Call your bank. Ask for a recall or freeze.
5 to 10 mins
Save emails, PDFs, headers and payment references.
10 to 15 mins
Notify your insurer and report through Report Fraud.
Speed matters because funds can move through several accounts within hours.
A bank recovery attempt and an insurance claim are separate routes. Ask your bank or payment provider to contact the receiving bank urgently.
Ask it to try a payment recall after authorised push payment fraud. Recovery depends on timing, account balance and the provider’s process.
Do not assume bank protections repay every business payment made after deception. A business payment may receive less protection than a consumer payment.
“Invoice fraud insurance” is often a marketing term. It is not always a defined insurance product.
A small business cyber policy may include liability cover and incident support. It may still exclude the transferred sum.
The transferred sum may need social engineering or funds transfer fraud cover. Crime, fidelity and professional indemnity cover address different losses.
Check the wording before you buy or renew
Read the schedule, endorsements and exclusions. Do not rely only on the headline cover list.
A cyber policy can help after an invoice scam only within its fraud cover, limit, excess and payment-check rules. Do not accept “cybercrime included” without seeing how the policy defines it.
The written wording matters more than a broad sales description.
Questions for the broker
Ask for figures, not broad assurances. Ask for the social engineering sub-limit and the excess.
Ask if the limit is an annual total or a per-claim limit. For many small firms, an excess between £250 and £1,000 can make small claims uneconomic.
Ask if incident response includes payment-recovery specialists, lawyers and computer investigators. These costs can matter even if the bank recovers some funds.
You may need to secure email and notify clients. You may also need to show what happened.
Conditions that can block a claim
Callback verification is a common policy condition. It means checking new bank details through a known contact route.
Do not call the number in the email, PDF or incoming call. Those routes may lead straight back to the criminal.
This works well in theory, but busy teams often skip it. A rushed “please pay today” request is exactly when the callback matters most.
Build a small-team payment routine
Require two channels for each bank-detail change. Keep the email record and make a callback to a known number.
For payments between £1,000 and £5,000, let a second person check the details. Above that range, require owner or director approval.
A small payment routine can stop a large loss.
Cyber cover is less urgent for a tradesperson who makes no electronic payments. The same applies if they hold no client data digitally. It also applies where they use only lower-risk payment channels. This guide cannot replace your policy wording, contract duties, bank terms or professional advice after a loss.
Before renewal, ask your broker to confirm key terms in writing. Ask about fraud wording, sub-limit, excess, MFA duty and callback rules.
That five-question check beats assuming a policy called “cyber” repays every fake invoice.
Your accounting software can support payment checks. Do not treat it only as a record after payment.
Turn on alerts for changes to supplier bank details. Limit who can create or change payees.
Review new payees before each payment run goes out. Set limits that need a second approval.
Check bank payments against approved purchase orders and genuine invoices each week. This gives your team a clear payment trail.
Give payment staff a short induction using real scam examples. Include a fake supplier invoice and an urgent bank-change request.
Also include a spoofed director email. These checks create an audit trail for recovery and an insurance claim.
If you pay suppliers by bank transfer, ask your broker for the exact fraud wording before renewal.
Common questions
Do sole traders need cyber insurance for fake invoices?
Yes, if a false transfer between £1,000 and £5,000 would harm cash flow or delay a job. Seek express social engineering or funds transfer fraud cover, as standard cyber cover may exclude authorised payments.
Does cyber insurance repay an authorised bank transfer?
It may, but only if the policy includes authorised payment fraud, social engineering or similar wording. Check the fraud sub-limit and excess, as they may differ from the main cyber limit.
What should I do in the first 15 minutes after invoice fraud?
Call your bank at once and ask it to recall or freeze the payment. Save emails and invoices, tell your insurer, and report fraud through Report Fraud.
Is professional indemnity insurance enough for invoice scams?
No, professional indemnity usually covers claims that your work caused a client’s financial loss. It may help if your error enabled the scam, but it rarely replaces funds transfer fraud cover.
Can cyber cover pay GDPR fines after invoice fraud?
It depends on the policy and whether personal data was involved. Regulatory costs and UK GDPR fines may be limited or excluded where insurance law prevents cover.
Why must I call a supplier on an old number?
An old, independently sourced number avoids the criminal’s email, PDF and incoming call route. Calling the number in the suspicious request may simply confirm the fraudster’s story.
What are the most common invoice scams affecting tradespeople?
Common scams include altered PDF invoices, spoofed supplier emails and hacked email threads. They also include fake subcontractor bank changes and director impersonation.
The pattern changes, but independent checks remain the main defence.
