Credit control at your coffee roaster rings, polite, slightly embarrassed. This month's £2,340 invoice is showing unpaid.

You paid it on the 5th, as you always do. The invoice email looked right: same logo, same invoice number format, same £2,340 as every month. One new paragraph said they had moved banks, so you updated the payee to the new details.

They never sent that email. The money went to a stranger's account, and you still owe the roaster.

How the email gets to you

UK Finance calls this an invoice and mandate scam: a criminal poses as a supplier, "claiming that the bank account details have changed", and it "often involves the criminal either intercepting emails or compromising an email account."

Two versions matter to a café.

The lookalike address. One letter off. Read on a phone in a hurry, it passes.
The real mailbox. The supplier's own email has been hacked, so the message comes from the right address and quotes a real invoice. That is why "it came from their usual email" proves nothing.

UK Finance's latest annual fraud report counts £41.3m lost to invoice and mandate scams across 2,305 cases in 2025. £28.0m of that, 68%, came from business and other non-personal accounts: 1,217 cases, or about £23,000 each on average. Those are UK-wide figures across every sector.

Our guide to reconciling supplier statements says, fairly, that nobody is trying to defraud you. Usually true. This is the exception.

The one control: ring a number you already hold

My rule is simple. Any change to a supplier's bank details waits until you have spoken to someone at that supplier, on a number you had before the email arrived.

The number comes from an old invoice, your contract or your saved contacts. Never from the email announcing the change, and never from a search result or an AI answer. Ask them to read their new details to you, not the other way round, and write down who you spoke to and when.

Official-looking emails need the same scepticism. Companies House lists fake "verify your identity" emails among current scams, and the real directors' identity verification is something you start on GOV.UK yourself.

The checks that back it up

Confirmation of Payee

At most UK banks, when you set up a payee, the name you type is checked against the name on the account:

Match: they agree.
Close match: you are shown the actual account name.
No match: they differ, and you are advised to contact the business.

For a business, use its registered or trading name.

Treat anything short of a match as a stop until the call is done. RBS puts it plainly: "Never be pressurised into continuing with the payment when the details don't fully match or where the account can't be checked."

Treat a match as a check, not proof. Pay.UK calls Confirmation of Payee "not a silver bullet". The check confirms the name fits the account, not that the account is your roaster's. A fraudster with an account in a matching name can still get through.

Hold changes, and use two people

Changed details go on hold until the call-back is written down. If your bank offers dual authorisation, turn it on for new and changed payees: one person sets it up, another approves it. For a solo operator, the logged call is the second person.

Read the chasers

The tell is an "unpaid" chaser or statement line for an invoice you know you paid. Do not assume it is their error: ring them on the known number. The weekly bank check in the 30-minute bookkeeping routine has the right rule: "Anything you cannot match gets a flag, not a guess."

If your invoices go through CostingBrik, that supplier's invoices are in one place when a chaser lands. It reads them for prices and costs, not bank details.

Who gets their money back

Since 7 October 2024, UK banks and payment firms have had to refund victims of authorised push payment (APP) scams under rules set by the Payment Systems Regulator (and, for CHAPS, the Bank of England). As of September 2026 they still apply, UK-wide:

Who: "individuals, microenterprises, and charities" (charities with annual income under £1m).
Which payments: Faster Payments and CHAPS between UK accounts. Not international, card or cheque, and not Bacs.
How much: up to £85,000 a claim, less an optional excess of up to £100.
How fast: banks should usually decide within five business days, and must close the claim within 35 business days.
How long you have: a bank can refuse a claim made more than 13 months after the last payment.

A micro-enterprise employs "fewer than ten persons" and has "either an annual turnover or an annual balance sheet total that does not exceed €2 million" (roughly £1.7m). The fuller definition in the UK payment services rules counts staff as full-time equivalents (part-timers as fractions, apprentices left out), can add linked businesses together, and looks at your size when you opened the account. Your bank decides, so ask them.

A refund is not automatic. The bank can refuse for gross negligence, which the PSR sets as "a higher standard than the standard of negligence under common law", and has to prove it. Micro-enterprises are held to the same consumer standard of caution as individuals, and going ahead after a warning "should not automatically" count as gross negligence.

The PSR is due to be folded into the FCA, subject to new legislation. It plans to consult on changes in December 2026 and decide in May 2027, so the current rules are the ones that matter for now.

Two cafés, one email

Illustrative numbers: the same £2,340 roaster invoice and lookalike email, paid by Faster Payments. Assume, as is usual, that paying the wrong account does not settle the invoice.

Café A has one site, 8 people working about 6 full-time equivalents, and turnover of about £420,000. It is likely a micro-enterprise.

Business B has two sites, 14 people working about 12 full-time equivalents, and turnover of about £900,000. Turnover passes, but 12 full-time equivalents fails the ten-person test, so it is not a micro-enterprise (assuming it was this size when it opened its account).

Café A, claim accepted with the full excess:

Refund: £2,340 - £100 = £2,240 recovered, £100 left.
It still pays the roaster £2,340. Total out: £2,340 + £2,340 - £2,240 = £2,440 for £2,340 of coffee.

Business B is outside the refund scheme. Its bank will try to recover what is left in the receiving account, and B can complain to the bank and then the Financial Ombudsman Service, but nothing is guaranteed.

Worst case: £2,340 lost and £2,340 still owed, so £4,680 out for £2,340 of coffee.
In 2025, non-personal accounts got back £10.6m of the £28.0m lost, or 37.9%, but that includes mandatory refunds to micro-enterprises and charities, so B is likely to get back less. Even at that rate: 2,340 x 10.6 / 28.0 = £886 recovered, £1,454 left. Total out: £2,340 + £2,340 - £886 = £3,794 for £2,340 of coffee.

Miss the chaser and next month's £2,340 goes to the saved payee too: £4,680 gone, and £4,680 still owed to the roaster. Café A gets back £4,680 - £100 = £4,580, with £100 left, if both payments form one claim. Business B, at worst, gets back nothing.

Same scam, very different protection. Café A's refund can still be refused for gross negligence, and ignoring a specific warning, such as your bank ringing after a no-match result, is the kind of thing a bank may point to.

Do you still owe the supplier?

Under the law of England and Wales, generally yes. Paying the wrong account usually does not settle the debt, because the roaster never received the money. The law is not fully settled, and Scots law may differ, so take advice on a large sum. If you agreed a process for changing bank details and followed it, your position may be stronger.

Meanwhile the invoice is ageing on their ledger, and an overdue balance is how accounts end up on stop with Thursday's delivery cancelled. Ring credit control yourself, agree a date and hit it.

The first hour, if you have paid

Ring your bank now. Use the fraud number on your bank's website or card, or 159, which is aimed at personal customers but reaches most UK banks. Say you were tricked into paying a fraudster (an APP scam) and ask them to contact the receiving bank. Speed matters: 13 months is only the outer cut-off, and money gets harder to trace.
Report it. In England, Wales and Northern Ireland, use Report Fraud, which replaced Action Fraud, at reportfraud.police.uk or 0300 123 2040. In Scotland, ring Police Scotland on 101. Keep the reference: your bank can ask you to report it to the police.
Ring the real supplier on the known number, and agree when you will pay.
Keep everything: the email with its full sender address, the invoice PDF, the payment confirmation. Then delete the saved payee.
Check your own email. The fraudster knew your invoice, so it is worth changing passwords and looking for forwarding rules nobody set up.

This week

Write the rule down. Changed bank details wait for a call on a number you already hold.
Put your top suppliers' real numbers on one card, from old invoices or contracts.
Check how your supplier payments go out: Faster Payments, CHAPS or Bacs.
Turn on dual authorisation for new payees, if your bank offers it.
Count your full-time equivalents, and ask your bank if you are near the line.

The email will look right. That is the point of it. The phone call takes three minutes, and it is the only check that asks the one person who knows.

Ed O'Brien has run Hunters Cake Company for 17 years across cafés in Witney, Burford, and a bakery in Carterton, Oxfordshire. He's building Brikly - modular tools that give independent café owners the same data the big chains have, without the big chain price tag.

Your supplier's bank details have changed. Ring them before you pay.