CyberCQR Top 10 · Governance
Payment diversion fraud: ten actions for boards
Ten actions a UK board can require to stop criminals redirecting client and firm payments through a compromised or imitated email. Five protect the mailboxes of the people who move money. Five make sure that no single email, and no single person, can change where money goes.
Summary
The point for boards. Payment diversion fraud succeeds when one email can change where money goes, and one person can act on it alone. The national refund rules cover individuals, micro-enterprises and charities, not a firm of up to 2,000 people paying its own suppliers [3]. Most of the controls below are switches in tools the firm already pays for, or rules the board can write in an afternoon.
What do the rules and regulators say?
Four sources shape what a board of a UK law firm, accountancy practice or financial adviser should expect.
- Refunds. Since 7 October 2024, banks must refund victims of authorised push payment (APP) fraud sent by Faster Payments or CHAPS, up to £85,000 a claim, if the victim claims within 13 months [4]. The rules cover individuals, micro-enterprises and charities [3]. The Payment Systems Regulator (PSR) made them; the government has confirmed they will move to the Financial Conduct Authority (FCA) when Parliament passes the law to merge the two [5].
- Client money (law firms). The Solicitors Regulation Authority (SRA) says missing client money must be replaced with extreme urgency, even after a cyber attack, and that managers are jointly and severally responsible [2]. It expects attacks that risk client money or data to be reported promptly [6].
- Verification. The National Cyber Security Centre (NCSC) advises checking important or unusual payment requests through a second channel, and telling suppliers and customers what to expect, such as bank details that never change [7]. The SRA advises confirming any change of bank details by phone and never by email alone [8].
- Reporting. In England, Wales and Northern Ireland, fraud is now reported to Report Fraud, the police service that replaced Action Fraud on 4 December 2025 [9]. A breach of personal data may need reporting to the Information Commissioner's Office (ICO) within 72 hours [10].
The ten actions
1. Make one named partner or director own payment fraud risk
Why it matters. Payment diversion sits between finance, IT and client service, so it often belongs to nobody. For a law firm, the SRA is clear that the managers carry the loss [2]. In other firms the loss falls on the firm or its clients, and in both cases the board answers for it.
What to do.
- Name one senior person, usually the finance director or, in a law firm, the compliance officer for finance and administration (COFA), who owns the controls below.
- Ask them to report on actions 2 to 10 at least twice a year, with any near misses.
- Put payment diversion on the firm's risk register in plain words: "client or firm money paid to a criminal after an email change".
- The owner can ask the IT provider or an outside adviser to do the work, but the accountability stays with the owner and the board, not with the provider or adviser.
2. Give the people who move money phishing-resistant sign-in
Why it matters. The NCSC notes that criminals often use a genuine email account they have got into, frequently one without a strong password or multi-factor authentication (MFA) [11]. Not all MFA is equal: the NCSC ranks FIDO2 methods, such as passkeys and security keys, first because they resist phishing, and text message codes last [12].
What to do.
- Start with the finance team, partners and directors, and anyone who can approve or release a payment or change a payee.
- In Microsoft 365, require the built-in "phishing-resistant MFA" authentication strength for those people through Conditional Access [13]. Microsoft documents that Conditional Access needs Microsoft Entra ID P1 [13]; check whether your plan already includes it.
- No exemptions for seniority. The people with most authority over money are the ones criminals most want to be.
3. Block automatic forwarding of email to outside addresses
Why it matters. A forwarding rule lets a criminal read every message in a payment thread without signing in again. In Microsoft 365 a single outbound policy setting blocks both inbox rules and mailbox forwarding to external addresses. The default can behave as "on" in some older tenants, so Microsoft recommends setting it explicitly [14].
What to do.
- Ask your IT provider to set external automatic forwarding to "Off" for the whole firm.
- Approve any exception by name, with a business reason and a review date.
- Ask for a yearly confirmation that the setting is still in place.
4. Make sure a person at the firm hears about new forwarding and inbox rules within hours
Why it matters. Microsoft's default alert policies include "Creation of forwarding/redirect rule" and "Suspicious email forwarding activity", which Microsoft describes as an early warning of a possible compromise [15]. An alert only helps if someone acts on it. Watch the watcher: if the alert goes only to the IT provider that runs your email, ask how long it takes them to tell you.
What to do.
- Find out who receives these alerts today. Add a named person at the firm.
- Agree in writing how quickly the provider must tell the firm about a suspicious forwarding rule on a finance or partner mailbox. In our view, hours, not days.
- Ask for a count of these alerts, and what was done about each, in the regular cyber report to the board.
5. Act on risky sign-ins, not just record them
Why it matters. Microsoft Entra ID Protection gives each sign-in a risk level based on how likely it is that someone other than the user is signing in [16]. Risk-based policies can then ask for stronger sign-in or a password change. Microsoft documents that these policies need Microsoft Entra ID P2 [16].
What to do.
- Ask what sign-in risk information you already have, and who looks at it.
- If you hold the licence, ask for risk-based policies to be switched on for the finance and partner group first.
- If you do not, ask what it would take to review risky sign-ins for that group each week. This is a decision for the board, not a purchase to make by default.
6. Require a call-back on a number you already hold
Why it matters. The fraud works because the request arrives in a real thread from what looks like a real person. A call to a number taken from the email reaches the criminal. A call to a number already on file, or taken from an independent source, does not. Both the NCSC and the SRA recommend this kind of second-channel check [7] [8].
What to do.
- Make it a rule: no change to bank details, and no first payment to new details, without a call-back to a number held before the request arrived.
- Give staff a short script (our Good Practice Guide has an example) and permission to delay a payment to complete it.
- Use Confirmation of Payee results as an extra check, not a replacement. Pay.UK is clear that a name match does not mean a payment is safe [17].
7. Write down the rules for changing a payee's details
Why it matters. Without written rules, every change is a judgment call made under time pressure, often late on a Friday. The NCSC suggests staff should know the normal way key tasks such as payments are done, so unusual requests stand out [7].
What to do.
- Adopt a one-page payment change procedure, approved by the board. Our guide has an illustrative template.
- Cover suppliers, clients, completions and refunds, not just supplier invoices.
- Treat urgency, secrecy and a new country or bank as reasons to slow down, never to speed up.
8. Require two people for payee changes and first payments
Why it matters. UK Finance's description of chief executive fraud is a scammer impersonating a senior figure to pressure a member of staff into an urgent payment [1]. A second person who did not receive the email breaks that pressure. If one person can change a payee and release the payment alone, the firm has designed the loss in advance.
What to do.
- Set up the banking platform and finance system so that changing a payee's details and releasing a payment need two different people.
- Do not let seniority override the rule. A partner's request still needs the check.
- Review the list of people who can approve payments every quarter.
9. Warn clients at the start, and keep warning them
Why it matters. Criminals target the client's mailbox as well as the firm's. The SRA advises telling clients you will never change your bank details by email [8]. A client who has been told this is far more likely to ring before sending a house deposit to new details. The refund rules may protect an individual client up to £85,000, but not above it, and not if their bank judges them grossly negligent [4].
What to do.
- Put a short, plain warning in engagement letters, in email signatures and on the page where clients first see your bank details.
- Repeat it by phone before any large transfer, such as a completion.
- Give clients a number to ring that is not in any email.
10. Rehearse the first hour
Why it matters. The NCSC's advice to a business that has paid a fraudster is to contact its bank directly, using the bank's official number, and to report the incident [18]. The SRA expects a prompt report where client money is at risk [6], and the insurer will need to know quickly [2]. Decision delays cost money: a firm that must first find out who may call the bank has already lost time.
What to do.
- Agree in advance who calls the bank's fraud line, who secures the mailbox, and who tells the insurer, the regulator and, if personal data was exposed, the ICO.
- Keep the bank's fraud number and the insurer's notification number somewhere that does not depend on email.
- Run a 30-minute tabletop exercise once a year using a diverted completion or supplier payment.
Questions for your next board meeting
- Who owns payment fraud risk, and when did they last report on it?
- Do the people who approve or release payments sign in with a phishing-resistant method, with no exemptions?
- Is external automatic forwarding blocked, and who at the firm is told when a forwarding rule is created?
- Can any one person change a payee's details and release a payment alone?
- Do our clients know we will never change our bank details by email?
- When did we last rehearse a diverted payment?
Glossary
| Term | Meaning |
|---|---|
| Authorised push payment (APP) fraud | Fraud where the victim is tricked into sending a payment themselves, so the bank treats it as authorised. |
| Chief executive (CEO) fraud | A criminal impersonates a senior person to pressure staff into an urgent payment. |
| Compliance officer for finance and administration (COFA) | The person in an SRA-regulated firm responsible for compliance with the SRA Accounts Rules. |
| Conditional Access | The Microsoft Entra feature that sets conditions, such as the sign-in method, before a person can reach a service. |
| Confirmation of Payee | A bank check that the name given for a payee matches the account details before a payment is sent. |
| Dual authorisation | A rule that two different people must approve an action, such as a payment or a change to a payee's details. |
| Invoice and mandate fraud | UK Finance's term for a payment meant for a real payee being redirected to a criminal's account. |
| Multi-factor authentication (MFA) | Signing in with something beyond a password, such as an app prompt, a passkey or a security key. |
| Phishing-resistant MFA | Sign-in methods, such as passkeys and security keys, that will not work on a fake sign-in page. |
| Sign-in risk | Microsoft's estimate of how likely it is that a sign-in was not made by the real user. |
Table 1. Terms used on this page (alphabetical).
Further reading
From CyberCQR
- Payment diversion fraud: why it is a board problem, not an IT one
- Stopping payment diversion fraud: a good practice guide
- Identity and Access Management: Top 10 Common Mistakes
- All green, still exposed: what your board's cyber report is not telling you
- Document library: every paper and tool
External
References
- [1]UK Finance, Annual Fraud Report 2026, 15 June 2026 (figures for cases reported by UK Finance members in 2025).
https://www.ukfinance.org.uk/system/files/2026-06/UK%20Finance%20Fraud%20Report%202026.pdf - [2]Solicitors Regulation Authority, Warning notice: money missing from client account, 21 June 2024.
https://www.sra.org.uk/solicitors/guidance/money-missing-client-account/ - [3]Payment Systems Regulator, PS25/5: APP scams reimbursement requirement, consolidated policy statement, May 2025.
https://www.psr.org.uk/media/rhelv4op/ps25-5-app-scams-reimbursement-consolidated-policy-statement-may-2025.pdf - [4]Payment Systems Regulator, APP fraud reimbursement protections, viewed 2 November 2026.
https://www.psr.org.uk/information-for-consumers/app-fraud-reimbursement-protections/ - [5]HM Treasury, A Streamlined Approach to Payment Systems Regulation: consultation response, April 2026.
https://assets.publishing.service.gov.uk/media/69ce4dad019a4faf2745b2d2/A_Streamlined_Approach_to_Payment_Systems_Regulation_-_Consultation_Response.pdf - [6]Solicitors Regulation Authority, SRA Update 123: Reporting cybercrime incidents, 11 January 2024.
https://www.sra.org.uk/news/news/sra-update-123-cybercrime/ - [7]National Cyber Security Centre, Phishing attacks: defending your organisation, reviewed 13 February 2024.
https://www.ncsc.gov.uk/guidance/phishing - [8]Solicitors Regulation Authority, How to reduce the risk of being affected by cybercrime, updated August 2023.
https://www.sra.org.uk/solicitors/resources/cybercrime/cybersecurity-advice/ - [9]Report Fraud, Report Fraud service goes live, 4 December 2025.
https://www.reportfraud.police.uk/news/report-fraud-service-goes-live/ - [10]Information Commissioner's Office, Personal data breaches: a guide.
https://ico.org.uk/for-organisations/guide-to-dp/guide-to-the-uk-gdpr/personal-data-breaches - [11]National Cyber Security Centre, Cyber threat report: UK legal sector, June 2023.
https://www.ncsc.gov.uk/files/Cyber-Threat-Report_UK-Legal-Sector.pdf - [12]National Cyber Security Centre, Multi-factor authentication for your corporate online services: recommended types of MFA, reviewed 26 September 2024.
https://www.ncsc.gov.uk/collection/mfa-for-your-corporate-online-services/recommended-types-of-mfa - [13]Microsoft, Conditional Access authentication strengths.
https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-strengths - [14]Microsoft, Control automatic external email forwarding in Microsoft 365, updated 18 August 2026.
https://learn.microsoft.com/en-us/defender-office-365/outbound-spam-policies-external-email-forwarding - [15]Microsoft, Alert policies in the Microsoft Defender portal, updated 3 August 2026.
https://learn.microsoft.com/en-us/defender-xdr/alert-policies - [16]Microsoft, What is Microsoft Entra ID Protection?, updated 30 October 2025.
https://learn.microsoft.com/en-us/entra/id-protection/overview-identity-protection - [17]Pay.UK, Confirmation of Payee: FAQs, viewed 2 November 2026.
https://www.wearepay.uk/what-we-do/overlay-services/confirmation-of-payee/faqs/ - [18]National Cyber Security Centre, Business payment fraud, viewed 2 November 2026.
https://www.ncsc.gov.uk/section/respond-recover/business-payment-fraud
Security is the outcome, not a solution.
CyberCQR is a UK cyber security advisory practice. We help boards of law firms, accountants and financial advisers switch on the controls they already own and write payment rules that hold under pressure, without vendor commissions or product resale.