CyberCQR Thinking · Governance
Payment diversion fraud: why it is a board problem, not an IT one
Payment diversion fraud happens when a criminal gets into, or imitates, an email thread and changes the bank details a payment goes to. For UK law firms, accountants and financial advisers it is a direct loss of client or firm money. It is stopped by identity controls the firm usually already owns and a few simple payment rules, not by buying new products.
Summary
The point for boards. When money is sent to a criminal's account because of a changed email, the loss lands on the firm and its leaders, not on the IT provider. For law firms, the managers must replace missing client money, from their own resources if needed [3]. The national refund rules mostly do not cover a firm of your size. The fix is a short list of controls the board can require and check: strong sign-in for the people who move money, an alert when a mailbox starts forwarding mail, and a rule that nobody changes bank details on the strength of an email. An IT provider or an outside adviser can do much of the work, but the accountability stays with the firm's partners and directors.
How does payment diversion fraud work?
UK Finance, the banking trade body, calls it invoice and mandate fraud. The victim means to pay a real supplier or client, and a criminal steps in to redirect the payment to an account they control [1]. In UK Finance's words, it often involves the criminal "intercepting emails or compromising an email account" [1]. Business email compromise (BEC) is the wider name for the same trick.
The National Cyber Security Centre (NCSC) describes two routes in [4]. Either the criminal signs in to a genuine mailbox, often one with a weak password and no multi-factor authentication (MFA), or they register a lookalike web address that differs from the real one by a letter. Then they copy or join a real email chain about an invoice or a completion, and send new bank details at the moment a payment is due. The email looks right because, very often, it is the real thread.
The Solicitors Regulation Authority (SRA) has reported for years that this is the most common cybercrime it sees. In its last dedicated risk outlook on the subject, more than 80% of the cybercrime reports it received in 2021 involved email [5]. Conveyancing is a frequent target because of the sums involved, but the SRA notes that criminals also target other practice areas, financial advisers and the firm's business clients [5].
The criminal does not need to break your systems. They need one mailbox, one convincing email and one person allowed to act on it alone.
Why is payment diversion a board problem?
Because of where the loss lands. There are three places, and none of them is the IT budget.
Client money
The SRA's warning notice on missing client money is blunt. A shortfall must be replaced with extreme urgency, even where it arose from theft or a cyber attack outside the firm's control. The managers are jointly and severally responsible, and it is irrelevant that the fault may not lie with any of them personally [3]. The SRA Accounts Rules say the same: money improperly withdrawn from a client account must be replaced immediately [6]. For a law firm, a diverted completion is a partner-level loss on day one.
The refund gap
Since 7 October 2024, banks have had to refund victims of authorised push payment (APP) fraud sent by Faster Payments or CHAPS, up to £85,000 per claim [2]. The Payment Systems Regulator (PSR) made these rules. The government confirmed in April 2026 that the PSR's work, including these rules, will move to the Financial Conduct Authority (FCA) once Parliament passes the necessary law [7]. At the time of writing, the rules still read as the PSR set them.
The important detail for a board is who they cover: individuals, micro-enterprises and charities [8]. A firm of 50 or 1,500 people paying its own supplier is not covered. UK Finance's figures show the difference. In 2025, individuals got back about 70% of what they lost to invoice and mandate fraud; businesses got back £10.6 million of £28.0 million, or about 38% [1]. A client who loses a house deposit may be refunded by their bank up to the cap, but they will still ask why your email was the one that fooled them.
Trust and the regulator
The SRA expects a cyber attack that affects a firm or its clients to be reported promptly, including attacks that risk the loss of client money [9]. If the mailbox held personal data, the Information Commissioner's Office (ICO) may need a report within 72 hours [10]. Clients rarely remember the details of a fraud. They remember which firm it happened through.
What we see in practice
In one engagement as acting chief information security officer (CISO), we found that the chief operating officer had decided the senior team should be "protected" from MFA and other basic account controls. The chief executive's sign-in details were managed by his personal assistant, and his iPad and other personal devices had no passcodes.
The senior team was then hit by a series of spear phishing emails. Each offered an "invoice" shared through SharePoint Online, which led to a fake Microsoft 365 sign-in page built to harvest passwords. The kit came from Caffeine, a phishing-as-a-service platform that Mandiant reported in 2022 [15]. The attacks failed only because the executives could not remember their own sign-in details. When they asked for help, we looked at what they were trying to sign in to and found the fake page.
That was luck, not a control. One typed password would have handed a criminal the mailbox with the most authority to ask for a payment. Worse, the same mailboxes received the emails for the firm's bank accounts and the executives' personal ones. Seeing that is what changed their minds. The people with the most power over money need the strongest sign-in, not exemptions from it. How that firm fixed it is in our case study Simpler and stronger.
What actually stops it?
Two sets of controls, and both are mostly things firms already have.
Identity: make the mailbox hard to take and quick to spot
- Phishing-resistant MFA for the people who move money. The NCSC ranks FIDO2 methods, such as passkeys and security keys, first among MFA types because they resist phishing [11]. Start with the finance team, partners and anyone who can approve or release a payment.
- No automatic forwarding to outside addresses. Microsoft 365 can block it for the whole firm with one setting, and Microsoft recommends setting it explicitly rather than leaving the default [12].
- An alert, to a person at the firm, when a mailbox starts forwarding or hiding mail. Microsoft documents default alerts for new forwarding rules and suspicious forwarding in its enterprise plans [13]; check what yours includes. The bigger question is who receives them.
Process: make one email unable to move money
- Call back on a number you already hold. Never a number in the email asking for the change. The NCSC and the SRA both recommend checking payment requests through a second channel [4] [14].
- Two people for any change to a payee's bank details, and for releasing a first payment to new details.
- Tell clients at the start that you will never change your bank details by email, as the SRA advises [14].
This is tool mastery, not tool buying. Most firms we see already pay for the sign-in controls, the forwarding block and the alerts. They have simply not been switched on, or the alerts go to nobody in particular. Our identity Top 10 covers the sign-in side in more depth.
Who sees the alert, and how fast?
Watch the watcher. In many firms of this size the IT provider runs the email system and also receives its alerts. An alert that a partner's mailbox has just started forwarding every message to an outside address is only useful if someone at the firm hears about it within hours. If it sits in a provider's queue, waits for internal triage and is reported to the client in a monthly service review, the money has long gone. The board should know who receives these alerts, and how quickly they must tell a named person at the firm.
The same applies to decisions. In the first hour after a suspected diversion, the useful actions are simple: call the bank's fraud line, secure the mailbox, and record what happened. Our Good Practice Guide sets out a first-hour plan. A firm that must first work out who is allowed to call the bank has already lost time, which is the same lesson as our briefing on the FCA's incident reporting rules.
Five questions for your next board meeting
- Can any one person in this firm change a payee's bank details and release a payment without a second person?
- Do the partners, directors and finance staff who approve payments sign in with a phishing-resistant method, with no exemptions for seniority?
- Is automatic forwarding of email to outside addresses blocked, and who is told when someone sets up a forwarding rule?
- Do our engagement letters and client communications say we will never change our bank details by email?
- If a payment was diverted at 4pm on a Friday, who calls the bank, and do they have the number?
Conclusion
Payment diversion fraud is common, it is cheap to commit and the national refund rules largely do not protect a firm of this size. It is also one of the few cyber risks a board can close quickly. Strong sign-in for the people who move money, a forwarding block and an alert someone actually reads, and a rule that bank details never change on the strength of an email will stop most of it. Our Top 10 Actions turn that into a checklist the board can own.
Glossary
| Term | Meaning |
|---|---|
| Authorised push payment (APP) fraud | Fraud where the victim is tricked into sending a payment themselves, so the bank treats it as authorised. |
| Business email compromise (BEC) | Fraud that uses a taken-over or imitated business email account to trick people into paying money or handing over information. |
| Call-back verification | Confirming a request by phoning the person on a number you already hold, never one given in the request. |
| Chief information security officer (CISO) | The person responsible for an organisation's information and cyber security, full-time, interim or fractional. |
| Forwarding rule | A mailbox setting that copies incoming email to another address, often used by criminals to watch a thread unseen. |
| Invoice and mandate fraud | UK Finance's term for a payment meant for a real payee being redirected to a criminal's account. |
| Lookalike domain | A web or email address made to look like a real one, for example by changing or adding a single letter. |
| Micro-enterprise | A very small business. Under the national refund rules, one of the few kinds of business that is covered. |
| Multi-factor authentication (MFA) | Signing in with something beyond a password, such as an app prompt, a passkey or a security key. |
| Phishing-as-a-service | A criminal subscription service that supplies ready-made phishing emails and fake sign-in pages. |
| Phishing-resistant MFA | Sign-in methods, such as passkeys and security keys, that will not work on a fake sign-in page. |
| Spear phishing | A phishing email written for one named person or a small group, often senior people or those who handle money. |
Table 1. Terms used on this page (alphabetical).
Further reading
From CyberCQR
- Payment diversion fraud: ten actions for boards
- Stopping payment diversion fraud: a good practice guide
- Identity and Access Management: Top 10 Must-Do Actions
- Simpler and stronger: fixing sign-in from the boardroom down (case study)
- Who is asking? What UK regulators expect of your board on cyber
- Document library: every paper and tool
External
- NCSC: Phishing attacks: defending your organisation [4]
- SRA: How to reduce the risk of being affected by cybercrime [14]
References
- [1]UK Finance, Annual Fraud Report 2026, 15 June 2026 (figures for cases reported by UK Finance members in 2025; return rates are our arithmetic from its tables).
https://www.ukfinance.org.uk/system/files/2026-06/UK%20Finance%20Fraud%20Report%202026.pdf - [2]Payment Systems Regulator, APP fraud reimbursement protections, viewed 2 November 2026.
https://www.psr.org.uk/information-for-consumers/app-fraud-reimbursement-protections/ - [3]Solicitors Regulation Authority, Warning notice: money missing from client account, 21 June 2024.
https://www.sra.org.uk/solicitors/guidance/money-missing-client-account/ - [4]National Cyber Security Centre, Cyber threat report: UK legal sector, June 2023.
https://www.ncsc.gov.uk/files/Cyber-Threat-Report_UK-Legal-Sector.pdf - [5]Solicitors Regulation Authority, Risk Outlook report: information security and cybercrime, 1 June 2022.
https://www.sra.org.uk/sra/research-publications/risk-outlook-report-information-security-cybercrime/ - [6]Solicitors Regulation Authority, SRA Accounts Rules, rule 6.1.
https://www.sra.org.uk/solicitors/standards-regulations/accounts-rules/ - [7]HM Treasury, A Streamlined Approach to Payment Systems Regulation: consultation response, April 2026.
https://assets.publishing.service.gov.uk/media/69ce4dad019a4faf2745b2d2/A_Streamlined_Approach_to_Payment_Systems_Regulation_-_Consultation_Response.pdf - [8]Payment Systems Regulator, PS25/5: APP scams reimbursement requirement, consolidated policy statement, May 2025.
https://www.psr.org.uk/media/rhelv4op/ps25-5-app-scams-reimbursement-consolidated-policy-statement-may-2025.pdf - [9]Solicitors Regulation Authority, SRA Update 123: Reporting cybercrime incidents, 11 January 2024.
https://www.sra.org.uk/news/news/sra-update-123-cybercrime/ - [10]Information Commissioner's Office, Personal data breaches: a guide.
https://ico.org.uk/for-organisations/guide-to-dp/guide-to-the-uk-gdpr/personal-data-breaches - [11]National Cyber Security Centre, Multi-factor authentication for your corporate online services: recommended types of MFA, reviewed 26 September 2024.
https://www.ncsc.gov.uk/collection/mfa-for-your-corporate-online-services/recommended-types-of-mfa - [12]Microsoft, Control automatic external email forwarding in Microsoft 365, updated 18 August 2026.
https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-policies-external-email-forwarding - [13]Microsoft, Alert policies in the Microsoft Defender portal, updated 3 August 2026.
https://learn.microsoft.com/en-us/defender-xdr/alert-policies - [14]Solicitors Regulation Authority, How to reduce the risk of being affected by cybercrime, updated August 2023.
https://www.sra.org.uk/solicitors/resources/cybercrime/cybersecurity-advice/ - [15]Mandiant (Google Cloud), The fresh phish market: Caffeine phishing-as-a-service platform, 10 October 2022.
https://cloud.google.com/blog/topics/threat-intelligence/caffeine-phishing-service-platform
Security is the outcome, not a solution.
CyberCQR is a UK cyber security advisory practice. We help law firms, accountants and financial advisers switch on the Microsoft 365 controls they already own and set payment rules a board can check, without vendor commissions or product resale.