The Second Call Rule: How a Five-Minute Phone Check Blocks Fake Invoice Fraud

You know the email. Same logo, same footer, same cheerful sign-off from the accounts team you've dealt with for three years. Everything about it is familiar except one line near the bottom: a new sort code and account number, with a polite note that the old account is being closed.

That's the whole scam. No malware, no hooded hacker, no dramatic breach. Just a convincing message at the right moment, and a payment run that's already half done.

Criminals call it payment diversion. Banks sometimes call it authorised push payment fraud. Your supplier will call it a nightmare, because the account that received your money was never theirs — and by the time anyone notices, it's been moved on.

Why this one keeps working

The fraudster doesn't need to break into your systems. They only need to read one email thread, or guess it. Common routes in:

• A compromised supplier mailbox. They sit quietly for weeks, learning your invoice rhythm, then strike just before a big payment is due.
• A lookalike domain. One letter swapped — rn for m, or a hyphen added — and the reply-to quietly sends you somewhere else.
• A phone call to your finance contact. Friendly, plausible, referencing a real invoice number they've seen in the stolen thread.

You are not the target. You're the delivery mechanism. That's why the usual security advice — antivirus, strong passwords, don't click links — doesn't quite cover it. The email may contain no links at all.

Red flags worth slowing down for

None of these prove fraud on their own. All of them justify a five-minute pause.

1. The change arrives mid-conversation, attached to an existing invoice rather than a new one.
2. There's urgency: month-end, a frozen account, an audit, a director on holiday.
3. The tone shifts slightly — a bit more formal, or a bit too casual.
4. The email comes from a name you know but the address ends differently, or the reply-to doesn't match the sender.
5. They ask you to confirm when payment has been made, so they can "track it".

The second call rule

Here's the habit that stops most of these attempts dead. It costs about four minutes and a phone call.

Rule one: never ring the number in the email. Ever. Use the number on your supplier record, your contract, their website typed in manually, or Companies House. The email's contact details are exactly what the fraudster controls.

Rule two: two people, not one. The person who spotted the change shouldn't be the person who clears it. Even in a two-person business, one of you reads the request and the other makes the call. It's basic segregation of duties and it's the difference between a near miss and a loss.

Rule three: ask a question the real supplier could answer. Not "is this your new bank account?" — a fraudster will simply say yes. Try: "Which of the two accounts on your letterhead are we paying into?" or "Who signed off invoice 4471?" Something only the genuine accounts team will know.

Rule four: write it down. Date, time, who called, who they spoke to, what was confirmed. If it ever goes wrong, that log is the difference between a clear process and a shrug.

Apply the rule to every new payee, every change of details, and any first payment over a limit you set yourself — £1,000 is a reasonable starting point for most small firms.

Put it in the contract, not just in someone's head

A verbal habit dies when the person who had it leaves. Better to build it in:

• Notification clause. Your suppliers must tell you about bank-detail changes by phone or through a portal — email alone doesn't count.
• Acknowledgement clause. No change takes effect until you've confirmed it under your verification procedure, in writing.
• Liability clause. If a supplier ignores your procedure and you pay the wrong account, the loss sits with them.
• Reciprocity. Say the same about your own details, and put a line on your invoices and email footers: we will never notify you of a change of bank details by email alone. Most small businesses skip this. It's the single cheapest protection going.

If the money has already gone

Don't wait for a colleague's opinion. Move.

1. Call your bank's fraud line, not the general customer number. Say "authorised push payment, possible fraud" and give the exact time, amount and receiving account. Ask them to raise a recall with the receiving bank immediately.
2. Keep the money still. If the receiving bank can flag the account before the funds are moved on, recovery is possible. That window is measured in hours, sometimes minutes.
3. Ring the supplier on a number you already hold. Their mailbox may still be compromised, so tell them anyway — they might be getting hit by the same operation.
4. Report it. Action Fraud for a crime reference; forward the phishing email to [email protected], the NCSC's reporting service.
5. Preserve everything. Full email including headers, timestamps, screenshots, your call log. Don't tidy the inbox.
6. Change your own credentials if there's any chance your side was accessed, and check your mail rules for anything auto-forwarding.

What protection actually exists

Since 7 October 2024, most UK banks have had to reimburse victims of authorised push payment fraud under Payment Systems Regulator rules. The rules cover consumers, charities and micro-enterprises — broadly, businesses with fewer than 10 employees and turnover or balance sheet under £2 million.

If you're inside that definition, you can claim, though there's a £100 excess per claim and a cap of £85,000. Claims are assessed on whether you ignored warnings your bank gave you, so the callback log matters.

If you're outside it — a 12-person firm, say — you're relying on your bank's recall efforts and goodwill. That's a much thinner safety net.

On insurance, read the policy, don't assume. Standard commercial combined policies frequently exclude "voluntary parting with money" and computer-related fraud. Crime and fidelity cover sometimes picks it up; cyber policies vary enormously on social engineering. Ask your broker directly whether a fraudulent bank-detail change would be paid — and get the answer in writing at renewal.

This week's five-minute job

Add the callback rule to your payment process, even as a single line in a shared document. Ring your three biggest suppliers and confirm their bank details against your records. Put the "we never change details by email" line on your invoices. Tell whoever runs the payment run, in person, today.

In 2026 the emails are better written than ever, and the fraudsters only need you to be busy. A four-minute phone call is still the cheapest fraud insurance on the market.