CyberCQR Good Practice Guide · Governance
Stopping payment diversion fraud: a good practice guide
How a UK law firm, accountancy practice or financial adviser of up to 2,000 people can stop criminals redirecting payments through email: the Microsoft 365 controls to switch on, the mailbox signs to watch, a payment change procedure, a client warning, a staff script and a plan for the first hour.
Summary
Payment diversion fraud, which UK Finance calls invoice and mandate fraud, cost UK businesses £28.0 million across 1,217 reported cases in 2025, and they got back £10.6 million of it [1]. For a regulated firm the money is often client money, and the loss lands on the firm's leaders. This guide sets out the controls that stop it. They fall into two groups: protect the mailboxes of the people who move money, and make sure no single email or person can change where money goes.
How to use this guide. Section 1 summarises the rules. Section 2 explains how the fraud works. Sections 3 and 4 cover the identity controls and the mailbox signs to monitor. Sections 5 to 8 give the process controls, with templates. Section 9 is the first-hour plan, and section 10 covers testing and board reporting. Section 11 is a checklist. The templates and wording are CyberCQR's illustrations, not legal advice or regulatory rulings: adapt them with your own advisers. Whoever does the work, the firm's partners or directors stay accountable for these controls and for any loss. The argument is in our briefing Payment diversion fraud: why it is a board problem, and the short version in our Top 10 Actions.
1. What do the rules say?
| Source | What it says, in short | What it means for the firm |
|---|---|---|
| UK Finance figures | Authorised push payment (APP) fraud losses were £576.4m in 2025, up 19%. Businesses lost £75.6m, of which £28.0m was invoice and mandate fraud [1]. | A common, current loss, not a rare event. |
| APP refund rules | Since 7 October 2024, banks must refund APP fraud sent by Faster Payments or CHAPS, up to £85,000 a claim, claimed within 13 months [2]. Covers individuals, micro-enterprises and charities [3]. | Your own payments are very unlikely to be covered. Your individual clients may be, but only up to the cap. |
| Who runs the refund rules | The Payment Systems Regulator (PSR) made them. The government confirmed in April 2026 that they will pass to the Financial Conduct Authority (FCA) once primary legislation is passed [4]. | No change for the firm. Check the current position before relying on any detail. |
| SRA: client money | Missing client money must be replaced with extreme urgency, even after a cyber attack; managers are jointly and severally responsible and may need to use their own resources [5]. Accounts Rules rule 6.1 [6]. | For law firms, a diverted payment is a partner-level loss. |
| SRA: reporting | Report attacks that affect the firm or its clients promptly, including those that risk client money or data [7]. | Decide in advance who reports, and how. |
| SRA: prevention | Confirm bank detail changes by phone, never by email alone; tell clients you will never change bank details by email [8]. | Sections 5 to 7 of this guide. |
| NCSC | Verify unusual payment requests through a second channel; make reporting quick and blame-free; tell suppliers and customers what to expect [9]. If you have paid a fraudster, contact your bank using its official number [10]. | Sections 5, 6 and 9. |
| Fraud reporting | Report Fraud replaced Action Fraud in England, Wales and Northern Ireland on 4 December 2025. In Scotland, report to Police Scotland on 101 [11]. | Update incident plans that still name Action Fraud. |
| ICO | Report a personal data breach without undue delay and within 72 hours, unless it is unlikely to put people at risk; record every breach [12]. | A compromised mailbox usually holds personal data. |
Table 1. The rules and guidance, paraphrased. The FCA's conduct rules also apply to regulated financial advisers; this guide does not attempt a legal analysis of them.
2. How does the fraud work?
The National Cyber Security Centre (NCSC) describes the pattern for the legal sector [13], and it applies equally to accountants and advisers. It has four stages.
- Getting in. The criminal phishes a password and signs in to a real mailbox, often one without multi-factor authentication (MFA). Or they register a lookalike address that differs from the real one by a letter.
- Watching. In a taken-over mailbox they often set up a rule to forward or hide messages, so they can follow a payment thread unseen. Microsoft lists suspicious inbox rules and new external forwarding among the signs of a compromised account [14].
- Striking. When a payment is due, they send new bank details in the real thread, or a copy of it, with a plausible reason and some urgency.
- Moving the money. Once paid, the money is moved on quickly. Speed of reporting to the bank matters.
The target can be the firm's mailbox or the client's. The Solicitors Regulation Authority (SRA) notes criminals also target intermediaries such as financial advisers, and the firm's business clients [15]. Controls must cover payments the firm sends and payments clients send to the firm.
3. Which identity controls matter, and do we already own them?
Most firms of this size run on Microsoft 365. The table shows where each control lives. Licence notes are given only where Microsoft documents them; ask your IT provider what your plan includes before buying anything.
| Control | What it does | Where in Microsoft 365 | Licence note |
|---|---|---|---|
| Phishing-resistant MFA for finance staff, partners and directors | Stops a phished password and code being replayed. The NCSC ranks FIDO2 methods (passkeys and security keys) first [16]. | Conditional Access policy using the built-in "Phishing-resistant MFA" authentication strength: Windows Hello for Business, FIDO2 security keys or certificate-based sign-in [17] | Conditional Access needs Microsoft Entra ID P1 [17] |
| Block external automatic forwarding | Stops inbox rules and mailbox forwarding sending mail to outside addresses | Outbound spam filter policy, automatic forwarding set to "Off" [18] | Microsoft recommends setting this explicitly, as the default can behave as "On" in some tenants [18] |
| Alerts on forwarding rules | Tells someone when a forwarding or redirect rule is created, or mail is forwarded to a suspicious address | Default alert policies "Creation of forwarding/redirect rule" and "Suspicious email forwarding activity" [19] | Microsoft lists these for its enterprise plans (E1, E3, E5) [19]; check your plan |
| Sign-in risk | Scores how likely it is that a sign-in is not the real user, and can demand stronger sign-in or a password change | Microsoft Entra ID Protection and risk-based Conditional Access [20] | Risk-based policies need Microsoft Entra ID P2 [20] |
| Email authentication for your own domains | Makes it harder for criminals to send email that claims to come from your domain | SPF, DKIM and DMARC records, as the NCSC recommends [13] | Configuration, not a product |
Table 2. Identity controls. This is tool mastery: the work is usually in switching these on and routing the alerts, not in buying. See our paper More tools, less security, and our identity Top 10 for wider sign-in controls.
Apply phishing-resistant MFA to the people who move money first, with no exemptions for seniority. Directors and partners are the people criminals most want to impersonate, which is the theme of our guide on board member identity protection.
4. Which mailbox signs should we monitor?
The signs below are drawn from Microsoft's guidance on compromised accounts [14] and its default alerts [19]. Agree with your IT provider which are monitored, who is told, and how quickly. Watch the watcher: if the provider both runs your email and receives these alerts, the firm needs its own line of sight. The response times are CyberCQR's illustrations, not a standard.
| Sign | Why it matters | Illustrative response time for finance and partner mailboxes |
|---|---|---|
| New inbox rule that forwards or redirects mail | The classic way to watch a payment thread | Named person at the firm told within 1 hour |
| Inbox rule that moves mail to an unusual folder, such as RSS Subscriptions or Notes, or deletes it | Hides replies from the real user, such as a client asking "did you change your details?" | Within 1 hour |
| Forwarding added to the mailbox itself | Copies all mail elsewhere | Within 1 hour |
| Suspicious messages in Sent Items or Deleted Items | Evidence of emails sent by the criminal | Same working day |
| Risky sign-in or sign-in from an unexpected place | Possible stolen password or session | Same working day |
| New MFA method or device registered | Attacker making their access last | Same working day |
| New app given consent to read mail | Access that survives a password change | Same working day |
| Account restricted from sending email | Often a sign the account is sending fraud or spam | Within 1 hour |
Table 3. Mailbox indicators. The sign list follows Microsoft's guidance; the response times are illustrations to agree with your provider.
5. A payment change procedure
The template below is an illustration of the controls the SRA and NCSC recommend [8] [9]. Adapt it to your systems and have the board approve it.
Illustrative template: changing a payee's bank details
- Scope. Applies to any new or changed bank details for a supplier, client, other party to a transaction, refund recipient or member of staff, however the request arrives.
- Email is never enough. No change is made on the strength of an email, letter, text or message alone, even from a known address or a partner.
- Call back. The person handling the request phones the payee on a number held before the request arrived (from the client file, the engagement letter or the supplier's contract), or from an independent source such as the payee's official website. Never use a number in the request.
- Confirm the details on the call. Ask the payee to read out the account details; do not read them out yourself. Record who was called, on what number, when, and what was confirmed.
- Second person. A second authorised person, who did not handle the request, checks the record and approves the change in the payments system.
- First payment. The first payment to new details also needs two people. For large sums, consider a small test payment confirmed by phone before the balance, and run the Confirmation of Payee check. Pay.UK is clear that a name match does not prove a payment is safe [21].
- Red flags mean stop. Urgency, secrecy, a change of bank or country, a request to bypass this procedure or a reason why the payee cannot take a call are all reasons to pause and escalate to the payment fraud owner.
- No penalty for delay. Anyone who delays a payment to follow this procedure is supported, including when a client or partner complains.
- Exceptions. Only the payment fraud owner can approve an exception, in writing, with a reason.
- Review. Reviewed every year and after any incident or near miss.
6. A call-back script for staff
A script removes the awkwardness that criminals rely on. This is an illustration; adapt the words to your firm.
Illustrative script
"Hello, this is [name] from [firm]. We've received a request to change the bank details we hold for you. Our policy is to confirm every change by phone on a number we already hold, so I'm calling you on the number from our file. Could you read me the new sort code and account number, and tell me why they changed? Thank you. Before any payment is made, a colleague will check this too."
If the person cannot be reached on the number held: "We can't make the change until we have spoken to you on the number we hold. Please call us on [firm's main number]." Do not accept a call-back to a new number.
7. An example client warning
The SRA advises telling clients you will never change your bank details by email [8], and the NCSC suggests telling customers to expect bank details that never change [9]. The wording below is CyberCQR's illustration for an engagement letter, email signature and client portal. Give it again by phone before any large transfer, such as a completion.
Illustrative client warning
"Criminals target clients of law firms, accountants and financial advisers with emails that appear to come from us. We will never change our bank details by email, text or phone call. Before you send us money, call us on [number held on our website and in this letter] to confirm our details. If you receive any message saying our bank details have changed, do not pay: call us. We are not responsible for money sent to an account other than the one we have confirmed with you by phone." [Last sentence: check with your own legal advisers and insurer.]
Ask clients to do the same for their details: if their bank details for a refund or completion change, the firm will call them on the number held to confirm.
8. Dual authorisation and payment release
UK Finance describes chief executive fraud as a scammer impersonating a senior figure to pressure staff into an urgent payment [1]. A second person who did not receive the request removes that pressure. Illustrative rules:
- Changing a payee's bank details and releasing a payment need two different people, enforced in the banking platform and finance system, not just in policy.
- No one approves their own request, whatever their seniority.
- The list of people who can approve payments and change payees is reviewed every quarter, and leavers are removed on their last day.
- Payment limits are set so that the largest payments, such as completions, need the most senior approver available, not the most convenient one.
- Where the bank offers a payee-change alert or a cooling-off period for new payees, switch it on.
9. What do we do in the first hour after a suspected diversion?
This plan is an illustration, not legal advice. Agree it in advance, keep it somewhere that does not depend on email, and name a deputy for each role.
| When | Action | Who (illustrative) |
|---|---|---|
| Minutes 0 to 15 | Call your bank's fraud line on its official number, not one in any email, and ask it to try to stop or recall the payment [10]. If a client sent the money, tell them to call their own bank at once. Note the time, amount, account details and the reference the bank gives. | Finance director or COFA |
| Minutes 0 to 30 | Tell the IT provider and secure the mailbox: block sign-in or reset the password, sign out all sessions, and remove unknown forwarding, inbox rules, MFA methods and app consents, as Microsoft sets out [14]. Preserve the evidence; do not delete the rules before they are recorded. | IT provider, overseen by the payment fraud owner |
| Within the hour | Warn other parties in the affected thread by phone, on numbers already held, that emails may be false. | Matter or client lead |
| Within the hour | Notify your insurer under the policy's notification terms. The SRA advises firms to tell their insurer when client money is missing [5]. | Finance director or COFA |
| Same day | Report to Report Fraud (England, Wales and Northern Ireland) or Police Scotland on 101 [11], and report the cyber incident through the government's service, as the NCSC suggests [10]. | Payment fraud owner |
| Same day | Law firms: replace any client account shortfall immediately [6] and report to the SRA promptly [7]. FCA-regulated firms: consider whether the FCA must be told under your existing notification obligations. | COFA or compliance lead |
| Within 72 hours of awareness | Decide whether the compromised mailbox exposed personal data in a way that needs reporting to the Information Commissioner's Office (ICO), and record the decision either way [12]. | Data protection lead |
Table 4. Illustrative first-hour plan. The order matters more than the exact times: the bank call comes first.
Decision delays cost money. If the plan has to be found, or the person allowed to call the bank has to be identified, time is lost. Our briefing on the FCA's incident reporting rules makes the same point about deciding fast.
10. Testing and reporting to the board
Controls drift. A forwarding exception is added for one person and never removed; a new finance assistant is given payment rights without a second approver. Illustrative checks:
- Quarterly: list of people who can change payees and approve payments; count of forwarding and inbox-rule alerts on finance and partner mailboxes, and the time taken to tell the firm; any payee changes made without a recorded call-back.
- Every six months: share of finance staff, partners and directors on phishing-resistant MFA, with any exemptions named; confirmation that external forwarding is still blocked.
- Every year: a 30-minute tabletop exercise using a diverted completion or supplier payment; a review of the procedure, script and client warning; a test call-back by someone posing as a supplier.
Put two or three of these in the quarterly cyber report, each with a tolerance. Our guide to board cyber reporting shows how.
11. Checklist
- A named owner for payment fraud risk, reporting to the board.
- Phishing-resistant MFA for everyone who approves or releases payments, with no seniority exemptions.
- External automatic forwarding set explicitly to "Off".
- Forwarding and inbox-rule alerts routed to a named person at the firm, with an agreed response time.
- Sign-in risk reviewed or enforced for the finance and partner group.
- A board-approved payment change procedure, with call-back to a number already held.
- Dual authorisation enforced in the banking platform and finance system.
- A client warning in engagement letters, signatures and the client portal.
- A first-hour plan, held outside email, with the bank and insurer numbers.
- Report Fraud named in the incident plan in place of Action Fraud.
- A yearly tabletop exercise and a quarterly report to the board.
Glossary
| Term | Meaning |
|---|---|
| Authorised push payment (APP) fraud | Fraud where the victim is tricked into sending a payment themselves, so the bank treats it as authorised. |
| Business email compromise (BEC) | Fraud that uses a taken-over or imitated business email account to trick people into paying money or handing over information. |
| Compliance officer for finance and administration (COFA) | The person in an SRA-regulated firm responsible for compliance with the SRA Accounts Rules. |
| Conditional Access | The Microsoft Entra feature that sets conditions, such as the sign-in method, before a person can reach a service. |
| Confirmation of Payee | A bank check that the name given for a payee matches the account details before a payment is sent. |
| DKIM, DMARC and SPF | Email authentication records that help receiving systems reject email falsely claiming to come from your domain. |
| FIDO2 | An open standard for sign-in with passkeys and security keys, which resists phishing. |
| Inbox rule | A mailbox setting that acts on incoming mail automatically, for example forwarding, moving or deleting it. |
| Invoice and mandate fraud | UK Finance's term for a payment meant for a real payee being redirected to a criminal's account. |
| Multi-factor authentication (MFA) | Signing in with something beyond a password, such as an app prompt, a passkey or a security key. |
| Sign-in risk | Microsoft's estimate of how likely it is that a sign-in was not made by the real user. |
Table 5. Terms used on this page (alphabetical).
Further reading
From CyberCQR
- Payment diversion fraud: why it is a board problem, not an IT one
- Payment diversion fraud: ten actions for boards
- Identity and Access Management: Top 10 Common Mistakes
- What UK regulators expect of boards on cyber: a sector guide
- Document library: every paper and tool
External
- NCSC: Phishing attacks: defending your organisation [9]
- Microsoft: Responding to a compromised email account [14]
References
- [1]UK Finance, Annual Fraud Report 2026, 15 June 2026 (figures for cases reported by UK Finance members in 2025).
https://www.ukfinance.org.uk/system/files/2026-06/UK%20Finance%20Fraud%20Report%202026.pdf - [2]Payment Systems Regulator, APP fraud reimbursement protections, viewed 2 November 2026.
https://www.psr.org.uk/information-for-consumers/app-fraud-reimbursement-protections/ - [3]Payment Systems Regulator, PS25/5: APP scams reimbursement requirement, consolidated policy statement, May 2025.
https://www.psr.org.uk/media/rhelv4op/ps25-5-app-scams-reimbursement-consolidated-policy-statement-may-2025.pdf - [4]HM Treasury, A Streamlined Approach to Payment Systems Regulation: consultation response, April 2026.
https://assets.publishing.service.gov.uk/media/69ce4dad019a4faf2745b2d2/A_Streamlined_Approach_to_Payment_Systems_Regulation_-_Consultation_Response.pdf - [5]Solicitors Regulation Authority, Warning notice: money missing from client account, 21 June 2024.
https://www.sra.org.uk/solicitors/guidance/money-missing-client-account/ - [6]Solicitors Regulation Authority, SRA Accounts Rules, rule 6.1.
https://www.sra.org.uk/solicitors/standards-regulations/accounts-rules/ - [7]Solicitors Regulation Authority, SRA Update 123: Reporting cybercrime incidents, 11 January 2024.
https://www.sra.org.uk/news/news/sra-update-123-cybercrime/ - [8]Solicitors Regulation Authority, How to reduce the risk of being affected by cybercrime, updated August 2023.
https://www.sra.org.uk/solicitors/resources/cybercrime/cybersecurity-advice/ - [9]National Cyber Security Centre, Phishing attacks: defending your organisation, reviewed 13 February 2024.
https://www.ncsc.gov.uk/guidance/phishing - [10]National Cyber Security Centre, Business payment fraud, viewed 2 November 2026.
https://www.ncsc.gov.uk/section/respond-recover/business-payment-fraud - [11]Report Fraud, Report Fraud service goes live, 4 December 2025.
https://www.reportfraud.police.uk/news/report-fraud-service-goes-live/ - [12]Information Commissioner's Office, Personal data breaches: a guide.
https://ico.org.uk/for-organisations/guide-to-dp/guide-to-the-uk-gdpr/personal-data-breaches - [13]National Cyber Security Centre, Cyber threat report: UK legal sector, June 2023.
https://www.ncsc.gov.uk/files/Cyber-Threat-Report_UK-Legal-Sector.pdf - [14]Microsoft, Responding to a compromised email account, updated 17 July 2026.
https://learn.microsoft.com/en-us/defender-office-365/responding-to-a-compromised-email-account - [15]Solicitors Regulation Authority, Risk Outlook report: information security and cybercrime, 1 June 2022.
https://www.sra.org.uk/sra/research-publications/risk-outlook-report-information-security-cybercrime/ - [16]National Cyber Security Centre, Multi-factor authentication for your corporate online services: recommended types of MFA, reviewed 26 September 2024.
https://www.ncsc.gov.uk/collection/mfa-for-your-corporate-online-services/recommended-types-of-mfa - [17]Microsoft, Conditional Access authentication strengths.
https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-strengths - [18]Microsoft, Control automatic external email forwarding in Microsoft 365, updated 18 August 2026.
https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-policies-external-email-forwarding - [19]Microsoft, Alert policies in the Microsoft Defender portal, updated 3 August 2026.
https://learn.microsoft.com/en-us/defender-xdr/alert-policies - [20]Microsoft, What is Microsoft Entra ID Protection?, updated 30 October 2025.
https://learn.microsoft.com/en-us/entra/id-protection/overview-identity-protection - [21]Pay.UK, Confirmation of Payee: FAQs, viewed 2 November 2026.
https://www.wearepay.uk/what-we-do/overlay-services/confirmation-of-payee/faqs/
Security is the outcome, not a solution.
CyberCQR is a UK cyber security advisory practice. We help law firms, accountants and financial advisers switch on the Microsoft 365 controls they already own, write payment rules that hold under pressure and rehearse the first hour, without vendor commissions or product resale.