Cyber security · Email
Invoice fraud doesn't need a deepfake. It needs a mailbox.
Most of the fraud coverage this year has been about AI voice cloning. The UK's own published figures tell a quieter story — and point at a control problem sitting inside Microsoft 365 rather than anything exotic.
If you have read anything about business fraud in the last year, you have probably read about AI. Cloned voices, deepfaked directors, a finance manager tricked by a video call. It makes for a genuinely alarming story.
The numbers UK Finance actually publishes point somewhere much more ordinary, and much more fixable.
What the figures say
UK Finance's Annual Fraud Report 2026, covering 2025, breaks authorised push payment fraud into eight types. Two of them matter here.
CEO fraud — someone impersonating a senior person to push a payment through, the category an AI voice clone would sit in — recorded 197 cases in the entire year, costing £5.6m. That is the lowest case total ever recorded for the type. It does carry the highest average loss per case of all eight types, at just over £28,000, so when it lands it lands hard. But it is rare.
Invoice and mandate scams — a genuine invoice intercepted and the bank details changed — took £28.0m from UK businesses across 1,217 cases. Also, for what it is worth, the lowest loss and case totals ever reported for that type.
Both are falling. We are not going to pretend otherwise, and anyone selling you something on the basis that fraud is exploding should be asked which figures they are using. But set the two side by side and the shape is clear: the unglamorous attack takes five times the money of the cinematic one, across six times as many cases.
One more figure worth holding onto. Business losses to authorised push payment fraud came to £75.6m, of which £34.6m was returned. Under half. This is not a category where the bank quietly makes you whole.
How the money actually moves
In most invoice redirection cases there is no impersonation at all, in the sense people imagine. Nobody does a voice. There is no urgent call from a director.
Instead, somebody has access to a mailbox — yours, or more often your supplier's. From there the attack is patient and almost boring:
- A real invoice is intercepted in transit, or simply read and copied.
- The bank details are altered. Everything else — the letterhead, the reference, the amount, the thread it sits in — is genuine, because it is genuine.
- A forwarding rule or a filter quietly moves the supplier's follow-up chasers out of sight, so the gap between payment and discovery stretches from days into weeks.
Nothing in that sequence requires sophistication. It requires a password, and nobody noticing a rule.
The part most practices never check
Here is the detail that catches people out, and it comes from Microsoft's own documentation rather than from us.
Microsoft's guidance on responding to a compromised email account lists "Recently added external email forwarding" and "Rules that automatically forward email to unknown addresses" among the signs that an account is compromised. That much is widely known.
Less widely known: inbox rules can be hidden from the user's own Outlook. The rules list the person sees can look completely empty while a rule is still running. Microsoft's remediation steps require listing them with the -IncludeHidden switch precisely because the normal view does not show them.
Which means "I checked and there's nothing there" is not evidence of anything, if it was checked from inside Outlook. It has to be checked by whoever administers the tenant, with the right tooling.
A fair question to ask your IT provider
When were mailbox forwarding rules last reviewed across the practice — including hidden ones — and is anyone alerted when a new external forwarding rule is created? If the answer is that nobody has looked, that is worth fixing before it is worth worrying about deepfakes.
Three controls, in the order we would do them
1. Multi-factor authentication, everywhere
This is the whole ballgame, because the attack starts with mailbox access. Microsoft's own wording is that they "highly recommend enabling and enforcing multifactor authentication (MFA) for the account". NCSC puts the reason plainly: "Having a second factor means that an attacker cannot access an account using just a stolen password."
It is also, as of April 2026, an automatic fail on a Cyber Essentials assessment if MFA is missing on a cloud service where it is available — so there is a second reason to get it done.
2. A real review of mailbox rules
Not a glance in Outlook. An administrative review across every mailbox, including hidden rules, plus alerting so a newly created external forwarding rule surfaces by itself rather than waiting to be found.
3. A verification rule everyone agreed to in advance
NCSC's phishing guidance suggests "ensuring that all important email requests are verified using a second type of communication" — a phone call to a number you already held, not one printed on the invoice.
Better still, make it mutual and put it in writing. NCSC suggests telling your suppliers and clients something close to: our bank details will not change at any point. It costs nothing, and it converts a judgement call made under time pressure into a rule nobody has to be clever about.
Common questions
Is AI voice cloning a real threat to a small practice?
It is real, but on the published numbers it is rare. CEO fraud accounted for 197 cases across the whole UK in a year, against 1,217 business cases of plain invoice redirection. If you have limited time and budget, spend it on mailbox security first — the controls that stop invoice redirection also make a cloned voice far less useful, because the attacker still cannot get into the mailbox to see what to ask for.
How would we know if a mailbox had been compromised?
Often you would not, which is the problem. The common first sign is external: a supplier asking where their payment went. Microsoft's own compromise indicators include recently added external forwarding and rules forwarding to unknown addresses — but since rules can be hidden from the user, that check has to be done administratively rather than from inside Outlook.
Does the bank refund invoice redirection losses?
Not reliably. Of £75.6m lost by UK businesses to authorised push payment fraud in 2025, £34.6m was returned — under half. These are authorised payments, which is what makes them hard to unwind, so prevention is worth considerably more than the hope of recovery.
Is this a finance problem or an IT problem?
It presents as a finance problem and it is caused by an IT one. The payment is made by the finance team, but the thing that made the fraudulent invoice convincing was access to an email account. Both halves need to hold.
What is the single cheapest thing we could do this week?
Tell your suppliers and clients, in writing, that your bank details will not change by email, and ask them to tell you the same. It costs nothing and it does not depend on anyone spotting anything.
Want someone to actually check your mailbox rules?
We can review forwarding and inbox rules across your Microsoft 365 tenant, including the ones that do not show up in Outlook, confirm where MFA is and is not enforced, and tell you plainly what we found. No obligation.
Book a free consultation →