Stop the diversion.
Protect the decision.

A payment diversion can start with an email account, a convincing telephone call or a compromised supplier. The person approving the transfer may see a plausible invoice rather than a technical warning. That is why fraud prevention needs finance, operations and security working from the same picture.

AI-assisted writing and synthetic media can make impersonation more convincing or easier to repeat. They do not establish that every persuasive message is AI-generated, and they do not remove the value of a verification process that does not rely on the incoming message being authentic.

Company accounts can also be used to move illicit funds. Cifas’s 2025 report records 6,744 company-current-account cases indicative of money muling in 2024, up 212% from 2,163. That is a particular filing category—not a 212% rise in all business fraud.

For an owner or finance director, the practical point is to examine unexpected money movement in both directions. A request to receive and pass on money, an unusual refund or a new counterparty can require scrutiny even when the business is not initially being asked to pay an invoice.

The useful question is where trust is being borrowed. A recognised name, an existing supplier record or a real customer account can make an instruction feel safe. Controls should verify the consequential change rather than treating familiarity as authorisation.

Avoid assuming that a particular sector’s position in a chart gives a reliable numerical probability of loss. Your own transaction patterns, privileged accounts, customer information and supplier dependencies provide a better starting point for deciding which controls need attention.

A fixed financial threshold can be useful for approval levels, but it should not become a safe route around verification. An attacker may test the process with a smaller payment or split requests. Build controls around the kind of change and the risk as well as the amount.

Give colleagues a realistic route when a senior person is unavailable. If the procedure exists only on paper and the only alternative is to hold up an essential service, staff will be tempted to improvise. Define who can resolve an urgent exception and how the decision is recorded.

Rehearse the workflow with finance and the people who routinely receive supplier or customer requests. Look for unclear ownership and awkward handoffs, then improve them. A training completion figure does not show whether a real request would be checked independently.

Strong authentication, controlled administrative access, timely removal of access and monitoring of important changes reduce opportunities for a compromised account to carry a believable instruction. They complement finance controls rather than replacing them.

Cifas’s separate Fraud Behaviours Survey 2024 found that 48% of respondents considered at least one tested form of first-party fraud reasonable. It surveyed 2,000 UK adults in May 2024 using hypothetical scenarios. This is an attitudes finding—not evidence that 48% of employees commit fraud.

The management implication is to make standards and reporting routes clear, including when the suspicious conduct is inside the business or involves a regular customer. Combine proportionate approval, reconciliation and segregation of duties with fair investigation. Do not use a population survey as a reason to presume individual wrongdoing.

Protect information that makes impersonation convincing: customer records, payment details, executive identity and access to shared mailboxes. Review backup and recovery arrangements too. Fraud can be accompanied by account compromise or data loss, and the response may depend on information that is no longer available in the affected account.

Insurance may help with particular losses and response costs under the policy. Check notification and approval requirements with the insurer or broker; do not assume every payment authorised under deception will be covered.

If you suspect a payment has been diverted, use the bank’s established urgent fraud route promptly and activate the incident plan. Preserve relevant messages and transaction evidence, obtain specialist support where needed and assess any affected accounts or personal information. A recovery plan should not depend on continued access to the compromised mailbox.