Payment fraud results in over £200,000 stolen from UK construction businesses

UK construction businesses lost more than £200,000 in the first three months of the year due to scammers asking for payments to be diverted, Report Fraud, a division of the police, has shared. 

Known as payment diversion fraud, this scam generally involves criminals contacting an organisation’s finance department pretending to be a regular supplier and asking to redirect future direct debits or invoice payments.

Some of the tactics utilised by criminals involve:

• Impersonation: criminals will make contact over email or phone call while impersonating existing suppliers, or sometimes staff within your own organisation
• Urgency and secrecy: they pressure you to act quickly and ask you not to share the request with others
• Changed payment details: they will claim that the supplier has changed their bank and future payments need to be paid into the new account

How to protect yourself

• Verify: if you receive a request to move money into a new bank account, contact the supplier directly using established contact details to verify and corroborate the payment request.
• Internal processes: establish robust internal processes for handling changes to payment details. For example, only designated employees should be able to make changes to payment arrangements.
• Payment method: avoid paying by bank transfer as it offers you little protection if you become a victim of fraud. Instead, use a credit card or payment services such as PayPal.
• Sensitive information: invoices, payment mandates, and other documents containing sensitive financial information should be stored securely and only be accessible to staff that need them to perform their duties. Sensitive documents should be shredded before they are disposed of.

What to do if you suspect fraud?

Report it to the police

If you have been a victim of cyber crime or fraud, report it to Report Fraud at www.reportfraud.police.uk, or by calling 0300 123 2040.

Sign up for Police Cyber Alarm

While this service will not help you regarding payment diversion fraud, this tool can support your internal cyber security.

Police Cyber Alarm is a free tool to help you understand and monitor malicious cyber activity against your network.

This service is made up of two parts: monitoring and vulnerability scanning.

Sign up to Police Cyber Alarm

Engage with your local Cyber Resilience Centre (CRC)

The CRC network works with some of the country’s top student talent to deliver fully funded cyber security services for small-and-medium organisations (SMOs).

This includes bespoke staff training, advice on security policies and testing services to identify the organisation’s specific vulnerabilities, improving risk awareness and cyber resilience.

The network provides long-term support through a customer journey model. This involves regular, engaging bitesize cyber security guidance to members, tailored to specific regions or sectors, in alignment with National Cyber Security Centre (NCSC) services, products and guidance.

Find your local CRC