Invoice scam | CC Recovery Ltd

How the scam works

Invoice and payment-redirection scams often follow an email account being compromised. A genuine-looking message says bank details have changed, and the payment goes to the scammer. They affect both businesses and people paying for property, building work or legal services.

1
A hacked or copied inbox

Criminals gain access to, or copy, the email of a supplier, builder, solicitor or estate agent you already deal with.
2
Watching and waiting

They wait for a real invoice or a large payment, such as a house deposit or a builder’s final bill.
3
New bank details

A message that looks genuine says the bank details have changed, often with a convincing reason and a sense of urgency.
4
Wrong account

You pay the new account. The real supplier is still waiting, and the money has already been moved on.

An example of how it happens

A couple renovating their home received an email from their builder’s address with an updated invoice and new bank details. The £18,000 final payment went to a fraudster, and the builder had never sent the email.

Illustrative example based on common cases, not a real client.

Warning signs

A message saying a supplier's bank details have changed
Small differences in an email address or domain
Urgency around a large or final payment
Contact details on the new invoice that differ from earlier ones
A request to keep the change quiet or not to call

How to protect yourself

Always confirm new bank details by phone, using a number you already had
Look closely at the sender’s address for small changes
Use Confirmation of Payee and act on any mismatch warning
Send a small test payment for large amounts and confirm it arrived

Can you get your money back?

Often, yes. It depends mainly on how you paid. These are the routes that usually apply to this type of scam.

Bank transfer (Faster Payments or CHAPS)

Since 7 October 2024, UK banks must reimburse most victims of authorised push payment fraud, up to £85,000 per claim, if it is reported within 13 months. Earlier payments may fall under the voluntary CRM Code or the bank’s duty of care.
How the money-back rules work

A general guide to UK rules. Every case depends on its facts, and nobody can guarantee an outcome. Check your bank.

If it has just happened

Speed matters. These steps protect you and give your bank the best chance to act.

Call your bank first, using the number on your card or its official website. Do not use numbers given to you by the caller or in a message.

A woman on the phone to her bank, holding her card and looking at her laptop.

Contact your bank now
Call the number on the back of your card or on your bank's official website. Tell them it is fraud. The sooner they know, the better the chance of stopping or tracing payments.
Stop further payments
Do not send any more money, even if you are promised a refund, a release fee or a withdrawal. Stop contact with the scammer.
Secure your accounts
Change passwords for your email and banking, remove any remote-access apps, and turn on two-step verification.
Report it
Report the crime to the police or your national fraud reporting service and keep the reference number.
Keep the evidence
Save messages, emails, screenshots, website addresses, wallet addresses and statements showing every payment.

A case handler wearing a headset, listening to a caller and taking notes.

How we can help

We build the case, you follow every step

We review what happened for free, help you gather the evidence, and pursue a complaint with your bank, escalating to the ombudsman if needed. You can also claim for free yourself.

Start your case See our process

Questions about this type of scam

I run a small business. Am I covered?

The UK reimbursement rules cover consumers, micro-enterprises and small charities. Larger businesses may still be able to complain.

The name check showed a mismatch. Can I still claim?

Possibly, but ignoring a clear warning can affect the outcome. We look at exactly what the warning said and when.

Is the supplier responsible?

Sometimes a supplier whose email was hacked may share responsibility. We look at every route to recovery.

Can you guarantee I will get my money back?

No. Nobody can honestly guarantee a recovery. Outcomes depend on how the payments were made, what your bank did, the rules that apply and the evidence available. Be wary of anyone who promises a guaranteed result.

Do I have to use a company to make a claim?

No. You can complain to your bank yourself for free and, if needed, escalate to the ombudsman yourself. Our Claim it yourself guide explains how. Some people prefer help with the evidence and the process, and that is what we offer.

What does it cost?

Our fees are set out in full on the Our fees page before you sign anything. You will never be asked to pay a "release fee", a "tax" or anything in cryptocurrency to receive recovered money.

How long does it take?

It varies. Banks usually respond to a complaint within a few weeks. If a case goes to the ombudsman, it can take several months. Your portal shows each step as it happens.

All questions