While advanced push payment fraud has dominated the headlines in recent years, another type of scam has been costing U.K. businesses millions — even though many companies are completely unaware of it.
Invoice fraud cost businesses £93 million in 2018, according to a U.K. finance report released this year. But despite the prevalence of these crimes, the same report found that more than four in ten businesses across the U.K. are totally ignorant of the threat.
According to industry insiders, one of the main reasons for this is because few businesses are willing to admit they have been victims of invoice fraud, meaning that the scale of the problem remains largely hidden.
“The thing about fraud is that nobody puts their hand up and says, 'We’ve been caught,'” said Neil Robertson, executive chairman of accounting technology company Compleat Software. “When you look at the SME market, 65% of businesses still rely on a lot of manual processes to deal with invoices, and in the digital age, those processes are wide open to abuse.”
While fraud is typically associated with professional criminals, a sizeable amount of invoice fraud is actually committed by company employees or existing suppliers who are exploiting loopholes in the company’s payment processes, according to Robertson.
“We’ve advised businesses to run their payroll bank account details against their supplier details and see whether there are any matches,” he said. “This has identified a number of frauds where a company employee has been submitting a small invoice every month, below a certain threshold, which means they can then approve these invoices themselves. One individual was paying themselves £950 per month for ten years. We’ve also seen that more than 50% of supplier invoices overstate the agreed price, and if that isn’t checked, the company then pays.”
However, industrialized invoice fraud committed by organized gangs is also becoming more frequent, as fraudsters have come to realize the potential opportunities. A common technique is simply to submit convincing invoices to as many organizations as possible, under the assumption that a portion of them will fail to check that the invoice has come from a legitimate supplier.
“We surveyed about 1,000 SMEs, and half of them told us that they had received a fraudulent or suspicious invoice in the previous year,” said David Williams, CFO at Tungsten Corporation, which develops invoice processing solutions for businesses.
According to research conducted by Tungsten, many fraudsters use phishing attacks to gain access to a company’s invoices, allowing them to create highly realistic duplicates. Another strategy is for fraudsters to contact the company using a similar email address to that of a legitimate supplier, and request that the supplier's payment details are changed.
“One company made these changes without first ringing up the actual supplier and double checking,” Robertson said. “When the next payments cycle came round, they paid out over £600,000.”
Williams said that the reason why a lot of companies are still falling victim to such attacks is due to a lack of sophistication in their accounting and finance departments, with many processes still being conducted manually.
“The only way to combat these kinds of fraud is through technology, but many companies don’t see this as a worthwhile investment,” he said. “When you’re still relying on human checking, it doesn’t matter how good people are with their processes and reviewing things — they still make mistakes, and fraudulent invoices slip through the net.”
Both Tungsten and Compleat say that invoice fraud is entirely preventable as long as businesses are willing to invest in digital invoice processing solutions. These technologies typically accept invoices as pdf files, read in the data, and then conduct an automatic matching process to validate and ensure that every piece of information on the invoice — from supplier bank account details to amount payable — matches what the company has on file.
Williams predicts that the advance of machine learning is only going to make these solutions more robust, eliminating opportunities for invoice fraud.
“Invoice fraud can be eradicated as long as companies have the appropriate defenses against it,” he said. “However, right now only one in 10 invoices are processed electronically. Until that number increases, and you reach the tipping point where fraudsters have less opportunities, they will carry on dedicating time and resources into trying to make money out of this.”
