More than £101 million was reported stolen through payment diversion fraud in a single financial year. The weakness criminals exploit is not always whether you recognise the sender. It is whether you independently verify where the money is going.
Picture a situation that will be familiar to anyone who has hired a builder, bought a property or paid a supplier.
You have been exchanging emails for weeks with a solicitor, a contractor or a supplier. The invoice is expected. The name is familiar, the amount is what you were told, and nothing about the transaction itself is surprising.
Then a small administrative note arrives: please use our new bank details.
You make the payment. Days later, the genuine recipient asks why they have not been paid.
This is an illustrative reconstruction based on the documented mechanics of payment diversion fraud. It does not describe a specific victim or incident.
The claim
The Verification Desk is testing a specific proposition:
Payment diversion fraud can succeed even when the victim recognises the apparent sender and is expecting to make a genuine payment, because criminals may compromise or impersonate a trusted participant and substitute fraudulent payment instructions.
This is narrower than “emails can be faked”. Most people know that. The question is what happens when the sender is recognised, the payment is real and the relationship is genuine, and whether “check the sender” still protects you.
What the new figures show
On 28 September 2026, City of London Police published new analysis of reports made to Report Fraud, the national reporting service. For the 2025/26 financial year it recorded:
- 3,657 reports of payment diversion fraud, a 3 per cent increase on the previous year.
- More than £101 million reported stolen by victims.
- 813 reports of invoice fraud, 22 per cent of all cases, making it the most common type.
The release also says that although the overall reported amount stolen has fallen, victims still reported more than £101 million stolen. The figure should not be read as a record or as a sharp rise. Reports rose slightly while the reported total fell, and the release does not say by how much.
The 63 per cent figure matters more for how people think about this crime. Individuals accounted for 63 per cent of reports. Organisations accounted for 35 per cent. The common mental image of payment diversion is a finance department paying a supplier. The data shows it reaching ordinary people too. The most frequently reported victim group was people aged 30 to 39. Among businesses, the construction sector recorded the most reports where industry information was available.
The release does not say how the £101 million divides between individuals and organisations, so this article does not either.
How it works
The police describe payment diversion fraud as occurring when criminals manipulate a victim into sending money to a bank account under their control instead of the intended recipient. The release identifies several routes, and they are not the same thing.
Impersonation. Criminals create convincing impersonation emails to persuade someone to change payment details, posing as organisations, suppliers, colleagues or service providers.
Compromised email accounts. The release says criminals commonly gain access to email accounts and use them to make requests appear genuine. A 2025 City of London Police release on conveyancing fraud, a property-transaction form of the same crime, describes criminals gaining access to email chains between buyers, sellers, solicitors and estate agents and then impersonating a trusted party.
Altered payment instructions. In invoice fraud, criminals send amended invoices or impersonate a legitimate payee and ask for money to go to a different account.
Booking and ordering platforms. The release says Report Fraud has identified criminals targeting online booking and ordering platforms used by hotels, restaurants and other service providers, diverting customer payments away from the legitimate business.
Pension accounts. “Emerging reporting” identifies a growing threat in which criminals gain access to pension accounts and attempt to divert funds.
These are documented mechanisms, not a single sequence. The release does not say how many incidents involved each one, and nothing here suggests every case involves a hijacked inbox. Some may involve only a convincing impersonation.
Why checking the sender may not be enough
The standard advice is to look at who the message is from. That works against a stranger. It works less well when the message really does arrive from, or appears to arrive from, someone you already deal with.
If an email account has genuinely been compromised, the familiar name, the earlier messages in the thread and the believable timing are not necessarily signs of safety. They can become part of what makes the fraudulent request convincing. The Detective Superintendent quoted in the release said payment diversion fraud is highly effective because it exploits trust.
The question you ask changes as a result.
The old question was: Do I recognise this sender?
The better question is: Have I independently verified these payment details?
Recognition tells you about a name. Verification tells you about an account number. A fraud that works at the account level can pass every test that operates at the name level.
None of this means a change of bank details is automatically suspicious. Real organisations do change banks. The point is that a change is an event that needs confirming whatever its source.
The AI question
The police assessment includes a warning about technology. It says criminals are increasingly able to use artificial intelligence to create convincing phishing emails, mimic writing styles and impersonate voices and video calls, making fraudulent communications harder to identify.
That is a statement about capability, not measured impact. The evidence does not establish what proportion of the £101 million involved AI, or whether AI has changed the number of successful frauds at all. Nothing in the release links AI to the 3 per cent rise in reports, or to any share of the losses. Treating a warning about what criminals can do as proof of what they did would go beyond the evidence.
The practical point stands without that link. If writing style, voice and video can be imitated, they are weaker proof of identity than they used to be, and independent verification matters more.
The test
FACT. City of London Police, drawing on Report Fraud data, records 3,657 reports and more than £101 million reported stolen in 2025/26. Individuals made 63 per cent of reports. Invoice fraud accounted for 813 reports. The police state that criminals exploit trust, use impersonation and compromised email accounts, and divert payments to accounts under their control.
INFERENCE. An expected invoice, a known name and an established relationship give a victim every reason to feel the payment is routine. That is The Verification Desk’s reasoning about why the fraud works, consistent with the police’s “exploits trust” description. The release does not measure victims’ state of mind.
LIMITATION. These are reported frauds. They are not the total incidence of payment diversion fraud, and they do not capture people who never reported. The release gives no further breakdown of the dataset beyond what is quoted here.
UNKNOWN. The true national incidence. The proportion of cases involving compromised email accounts, pure impersonation, AI or any specific technique. How the £101 million divides between individuals and organisations.
Verdict
V5 — VERIFIED.
Payment diversion fraud exploiting trusted relationships and altered payment instructions is documented by the UK’s national lead force for fraud. Report Fraud data records 3,657 reports and more than £101 million in reported losses during 2025/26. The evidence does not establish how many incidents involved any particular technical method, or AI.
V5 applies to what the source documents: the existence of the crime, its core mechanism and the reported figures. It does not extend to every attack chain described elsewhere online.
How to protect yourself
The central rule: never verify changed payment details through the same communication that told you they had changed. If the message is the problem, the message cannot be the check.
- Treat a changed bank detail as its own verification event. Contact the supplier directly, using established contact details, to verify and corroborate the request. That means a number or address you already hold or have independently obtained, not the one in the new message.
- Do not rely on the thread looking genuine. A convincing email history is not evidence the account is correct.
- For large sums, consider a small test payment first. Confirm with the intended recipient that it arrived before sending the full amount. The confirmation is the point. A test payment alone proves nothing if the account belongs to a criminal, so treat it as an extra step and not a replacement for verifying the details.
- Be wary of urgency alongside changed payment details. Report Fraud identifies urgency and confidentiality as warning signs in payment-diversion and business-email-compromise fraud. A demand to act quickly should increase the need for independent verification, not reduce it.
- Businesses should limit who can change payment arrangements. The police recommend robust internal processes, for example allowing only designated employees to alter payment details, and storing invoices and mandates securely.
If you have already paid
Speed matters. The police advice is to inform your bank as soon as possible. A 2025 City of London Police release advises calling your bank immediately using the number on the back of your bank card.
- Contact your bank or payment provider now, through a channel you trust, and say the payment may have been induced by fraud.
- Contact the genuine intended recipient using details you already hold, so they know the money has not arrived.
- Keep the evidence: emails, invoices, messages, account details and timestamps.
- Secure your email account if you suspect it has been compromised.
- Report it. In England, Wales and Northern Ireland, report to Report Fraud. In Scotland, report fraud to Police Scotland on 101.
Afterwards, review your payment processes and monitor bank statements. Police also warn that fraudsters sometimes recontact victims claiming they can recover the money. This is a secondary scam, and the advice is to hang up.
Back to the invoice
Return to the expected invoice. It arrived from a name you know, with an amount that made sense, in a conversation that had been genuine until the moment it was not.
The question is no longer simply whether the email looks genuine. The better question is whether the instruction to send money to that particular account has been independently verified.
Familiarity is not verification.
TVD VERDICT: V5 — VERIFIED
Verified: Payment diversion fraud exploiting trusted relationships and altered payment instructions is documented by City of London Police / Report Fraud.
Not established: How many incidents use compromised email, AI or any single attack technique.
Action: Independently verify new or changed payment details before sending money, using a communication route separate from the message requesting the change.
Sources
- City of London Police — Criminals steal £101 million through Payment Diversion Fraud, 28 September 2026.
- City of London Police — payment diversion fraud targeting property transactions, 7 October 2025.
- Report Fraud — Payment diversion fraud.
- City of London Police — Report Fraud service launch and UK reporting routes, December 2025.
Leave a Reply