Invoice fraud and fake HMRC emails: how to protect your business

Scams spike around tax deadlines. Here are the common ones and the simple checks that stop them.

By the AvrioBooks team · · 6 min read

Invoice fraud and fake HMRC emails: how to protect your business

This is general information, not tax or legal advice. Rules and rates change, so check GOV.UK or ask an accountant.

Fraudsters target small businesses because the controls are often light. Scam activity tends to rise around tax deadlines, so it is worth a quick review now.

Common scams

  • Changed bank details. An email “from a supplier” says their account has changed.
  • Fake invoices. A bill for something you never ordered, often small enough to be paid without a second look.
  • Fake HMRC messages. Emails, texts or calls claiming a refund, a penalty or an arrest. HMRC does not ask for payment or bank details by text or email in this way.
  • The boss scam. A message that appears to come from a director asking for an urgent transfer.

Warning signs

  • Urgency, pressure or threats.
  • Slightly wrong email addresses or links.
  • A request to keep it quiet or skip the usual process.
  • New bank details, or a payment you did not expect.

Simple controls that work

  1. Verify changes by phone using a number you already hold, not one in the email.
  2. Match every bill to an order or contract before paying. See purchase orders explained.
  3. Use two people for larger payments, with approvals.
  4. Turn on two-factor sign-in for email, banking and accounting.
  5. Never click links in unexpected tax messages. Go to GOV.UK directly.

If you are caught out

  • Call your bank immediately and ask them to recall the payment.
  • Change passwords and check for forwarding rules on your email.
  • Report it to Action Fraud, and to HMRC if it used their name.
  • Tell your accountant.

How AvrioBooks helps

Use two-factor authentication and roles and permissions. On the Premium plan, approval workflows stop a single person approving a bill alone, and the audit log shows who changed what. See approval workflows and security.

Frequently asked questions

How do I spot a fake supplier email?

Look for urgency, slightly wrong addresses and new bank details. Verify any change by phone on a number you already have.

Does HMRC ask for bank details by email or text?

HMRC does not ask for payment or bank details this way. Go to GOV.UK directly.

What should I do if I paid a scammer?

Call your bank immediately, then report it to Action Fraud and tell your accountant.

How can software help?

Two-factor sign-in, roles, approval workflows and an audit log reduce the risk.

Written by the AvrioBooks team. We build cloud accounting software for small businesses, freelancers and their accountants, from Qodexify. This article is general information, not tax, legal or financial advice. Check GOV.UK or ask an accountant about your own situation.
Try AvrioBooks free Start a 30-day free trial with everything in Premium, no card needed. Start free trial
Newsletter

Accounting tips, tax dates and product news

Practical bookkeeping, VAT and Making Tax Digital guidance for freelancers and small businesses, plus AvrioBooks updates.

By subscribing you agree to receive emails from AvrioBooks. Unsubscribe at any time. See our privacy policy.

Sign up freeContact us