AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
Invoice fraud, also called payment diversion or business email compromise, usually starts with a fraudster reading or imitating a supplier's email and sending a real-looking invoice or a 'change of bank details' notice. The money goes to an account the fraudster controls. UK protections such as Confirmation of Payee and the APP scam reimbursement rules cover UK domestic payments, not international transfers, so verifying bank details by phone before paying is the main defence.
The pattern is familiar to finance teams on both sides: a long-standing Nigerian supplier, a UK buyer, a big invoice due, and an email that says the supplier's bank account has changed. It reads exactly like the supplier, because it may have come from the supplier's own mailbox. By the time anyone calls, the money has moved on.
How it happens
- Access. The fraudster gets into a supplier's or buyer's email through a phishing link or a reused password, or registers a lookalike domain one letter off.
- Watching. They read threads quietly to learn invoice timing, amounts and who approves payments.
- The switch. At the right moment they send an invoice with new bank details, or a letter on copied letterhead announcing a new account, often with a reason (an audit, a new bank, a currency change).
- Pressure. Urgency, a threat to stop supply, or a request to keep it quiet.
- Cash-out. Funds arrive in a mule account and are moved quickly, sometimes across borders.
Why UK-Nigeria payments are harder to recover
UK domestic protections stop at the border. Pay.UK says Confirmation of Payee, which checks the account name before a payment, covers Faster Payments, CHAPS and Bacs within the UK and international payments are not in scope. The Payment Systems Regulator's APP scam reimbursement rules, as Nationwide summarises them, apply to UK payments made by Faster Payments or CHAPS and exclude international payments. A diverted payment to an account in Nigeria, or one routed through several countries, relies on the banks' goodwill and speed rather than a fixed refund right.
Checks that stop it
- Call back on a known number. Any new or changed bank details are verified by calling the supplier on a number already on file, never one in the email.
- Hold period. A change of bank details triggers a short hold and a second approver before the first payment.
- Name check. Use Confirmation of Payee for UK payees; for Nigerian accounts, ask the supplier to confirm the account name and compare it with the name the bank shows when you set up the transfer.
- Test payment. For a new account, send a small amount and have the supplier confirm receipt by phone.
- Email security. Multi-factor authentication on every mailbox, alerts for forwarding rules, and training on lookalike domains.
- Insurance check. The NCSC notes that standard cyber policies may exclude business email compromise fraud; ask whether yours covers it.
The Nigerian side of the trade can be the target too. A fraudster who controls the UK buyer's mailbox can tell the Nigerian supplier that payment has been sent, buying time while goods are shipped on credit. Suppliers should confirm receipt from their own bank statement, not from the buyer's email.
Example
Example only. A UK importer owes a Lagos supplier £18,000. An email from the supplier's usual address attaches an invoice with a new account 'because of our bank's upgrade'. The accounts clerk calls the number on the email signature, which the fraudster added, and is reassured. A call to the number already in the supplier file would have reached the real supplier, who had changed nothing.
Who is liable when it goes wrong
Between buyer and supplier, the question of who bears the loss usually depends on the contract and on whose systems were compromised. If the buyer paid the wrong account, the supplier will often say it has still not been paid. If the supplier's mailbox was hacked, the buyer may argue the supplier should bear some of the loss. Courts and insurers look at what each side did to check. That is why a written call-back rule, applied every time and logged, matters: it is evidence that you took reasonable care.
Put the rule in your supplier terms as well. A clause that says bank details will only ever change by signed letter confirmed by phone, and that you will not act on email alone, sets the expectation for both sides.
If it has happened
- Call your bank immediately and ask it to contact the receiving bank to freeze the funds. Speed matters more than anything else.
- In England, Wales and Northern Ireland, report to Report Fraud, which replaced Action Fraud (0300 123 2040, reportfraud.police.uk); in Scotland, Police Scotland on 101.
- Tell the supplier through a verified channel, since their email may be compromised.
- Preserve the emails with full headers for investigators.
- Review how the details were changed and fix the control.
For the Nigerian side of reporting, see supplier bank details fraud in Nigeria.
Where Pryme fits
On a Pryme Business Account, supplier payments above a set ceiling need a person's approval and every action is recorded, which gives a second pair of eyes at the moment fraud usually succeeds. Security uses an authenticator app rather than SMS codes and a transaction PIN. See also purchase controls for a UK-Nigeria team and checking a Nigerian supplier before paying.
Questions people ask
What is business email compromise?
A fraud in which someone gains access to or imitates a business email account to redirect payments or obtain information.
Will my bank refund an invoice fraud payment to Nigeria?
UK reimbursement rules cover domestic Faster Payments and CHAPS, not international payments. Recovery then depends on how fast the banks can freeze the funds.
How do I verify a supplier's new bank details?
Call the supplier on a number already on file, hold the first payment for a second approval, and consider a small test payment.
Where do I report invoice fraud in the UK?
Report Fraud (formerly Action Fraud) in England, Wales and Northern Ireland, and Police Scotland on 101 in Scotland. Tell your bank first.
Sources
- Pay.UK: Confirmation of Payee FAQs (modified 30 Mar 2026) · accessed Oct 2026
- Nationwide: Payment Systems Regulator APP scam reimbursement rules · accessed Oct 2026
- City of London Police: Report Fraud service goes live (4 Dec 2025) · accessed Oct 2026
- NCSC: Cyber insurance guidance · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.