Invoice fraud
A charity supporting cancer patients was defrauded of more than £90,000 as a result of a bogus change to a supplier’s bank account details.
The charity received an email purportedly from a regular supplier asking for their bank account details to be changed. The new account information was provided on company letterhead as an attachment.
The request was forwarded to the finance department and processed. Two invoices were then paid to the new account.
The genuine supplier contacted the charity to ask why their last two invoices had not been paid. Internal enquiries established that the supplier’s bank account details had been changed prior to the payments being made.
The letter attached to the email from the supplier requesting the change was found to be fake. It was undated and contained poor grammar. An internet search also revealed that the sort code and account number did not match the stated bank branch.
The charity immediately notified their bank to stop any further payments, freeze the bogus supplier account and retrieve any remaining funds.
What changed as a result?
A complete review of financial controls and managerial checks was undertaken. As a result, the authority needed to change bank account details in future was restricted to more senior staff.
Key learning points
- Fully train staff who process supplier invoices so that they are able to spot irregularities, such as changes to supplier names, addresses and invoiced amounts.
- Always phone the supplier to verify any changes to their bank account details. Do this before payment is made, and use the phone number on the supplier’s website or the number held on file.
- Request proof of bank details. The account name and supporting details should be clearly visible. Check for things like poor grammar, spelling mistakes and blurred logos.
- Issue remittance advices to your suppliers so they know when a payment has been made.
- Ensure that all staff follow controls and documented procedures. As part of this, introduce some form of managerial checks for key controls.
