Use Readable text for larger type, or zoom in on the pages.
Fair Play Council
When a Changed Invoice Becomes a Payment Loss: Evidence from the UK Fair Play Member Group
Subject: Business-payment fraud, payee verification, recall and reimbursement
I. Purpose and basis of submission
1.This submission places member evidence before the Fair Play Council for FP-001, the proposed Business Fraud Standard. The six members who authorized publication are based in the United Kingdom. Their identities and business names are withheld. The accounts below are presented as members’ reports, not as findings by a court, regulator or independent investigator. Documents were described to the Secretariat by the members; this submission does not reproduce account numbers, personal data, invoice details or other identifying material.
2.Four members described a payment loss after receiving or acting on a message that appeared to change payment instructions, or after being induced to make an authorized payment to a fraudulent payee. Two further members contributed evidence about attempted or disrupted incidents and the work required to verify payment instructions. The four reported losses total £14,695, approximately US$18,660 using an indicative conversion convention of £1 = US$1.27. The conversion is for comparison only and is not a statement of the exchange rate on any transaction date.
3.The accounts concern different businesses and are not claims against a named company. Members described the relevant institutions only by role: a bank, a payment provider, a supplier, an email service or a large marketplace. No inference about the conduct of any particular institution is intended.
4.The submission is relevant to an established burden. The United Nations estimates that micro, small and medium-sized enterprises represent about 90 per cent of businesses, 60–70 per cent of employment and around half of global GDP.1 These global estimates do not establish the scale of fraud in the United Kingdom. They explain why payment controls designed for large organizations may leave smaller firms with limited capacity to absorb a single loss.
II. Evidence received
5.The members supplied or described records from four reported loss events. The Secretariat recorded the following chronology from their accounts. Dates and amounts are reported by the members; the Secretariat has not independently authenticated them. Where a member could not establish the precise time, the chronology uses the day or sequence provided.
| Member account | Reported sequence and records | Amount at stake |
|---|---|---|
| A | Received a message purporting to update a supplier’s payment details; checked the message against an earlier invoice; made an authorized bank transfer; then contacted the bank and supplier after the supplier said payment had not arrived. Records described included the original invoice, the changed instruction, transfer confirmation and subsequent correspondence. | £3,840; approximately US$4,880 |
| Member account | Reported sequence and records | Amount at stake |
|---|---|---|
| B | Received a request to settle an invoice to a new payee following a thread that appeared to continue prior correspondence. After payment, the expected supplier confirmed that its account had not changed. Records described included email headers, the invoice, bank confirmation and a report made to the bank. | £7,260; approximately US$9,220 |
| Member account | Reported sequence and records | Amount at stake |
|---|---|---|
| C | Made a time-sensitive payment after a message appeared to come from a regular business contact. The member noticed a mismatch in the payee information and contacted the payment provider. The member described a delayed response and an unsuccessful request to recover the funds. Records described included the payment receipt, the message and support correspondence. | £1,180; approximately US$1,500 |
| Member account | Reported sequence and records | Amount at stake |
|---|---|---|
| D | Paid an invoice after receiving amended bank details through a channel the member believed to be consistent with earlier dealings. A later call using a previously held contact number confirmed that the supplier had not requested the change. Records described included the original and amended invoice, call notes, transfer confirmation and a complaint reference. | £2,415; approximately US$3,070 |
6.The four records show a common practical sequence: a payment instruction changes or appears to change; the payer authorizes a transfer; the discrepancy becomes clear after payment; and the payer seeks an urgent recall. In each loss account, the business considered the payment authorized because a person at the business approved it. Members’ use of “authorized” describes the payment process, not a conclusion that the payer intended to pay a fraudster or that a reimbursement rule necessarily applies.
7.Members described different ways of discovering the fraud: a supplier reported non-payment; the payee details did not match; or a later check through a known contact channel contradicted the instruction. Their evidence does not establish how the fraudulent messages were created or who sent them. It does establish that the businesses relied on information presented as part of ordinary commercial communication, and that recognition of the problem came after the payment had been initiated.
8.The records described by members show the importance of keeping a clear audit trail. An invoice alone may not show whether a payment instruction changed, when the change was received, what verification took place or when the payer first asked for help. Members therefore recommend that financial providers preserve and provide the payment details, timestamps, complaint references and recall actions needed to make a timely report and pursue the case.
III. Five-part pattern test
9.The Council’s five-part test asks whether evidence demonstrates Volume, Frequency, Consistency, Spread and Corroboration. The Secretariat distinguishes the member accounts in this submission from the wider Fair Play evidence base. As of 18 May 2026, the Fair Play Council had 85 members in 34 countries and 112 reports from 35 countries. The median amount at stake in Fair Play reports was approximately US$4,290. There had been 62 Fair Play reports in the preceding 30 days. These are council-wide figures, not counts or totals for the UK group or for this submission.
Volume
10.The four loss accounts are a limited sample. They do not measure the prevalence of fraud among UK businesses, establish a national loss total or support a projection beyond the cases described. They do provide four specific instances in which a small business reported an authorized payment made on the basis of a fraudulent or compromised payment instruction. The amount at stake across those four accounts is £14,695, approximately US$18,660 under the stated comparison convention.
11.The wider Fair Play evidence base contains 112 reports from 35 countries, but those reports include different circumstances and are not all evidence of the particular pattern described here. The Council should not treat the 112 reports as a count of business email compromise losses or as a UK estimate. Volume therefore supports continued examination of the issue, but this submission alone does not establish its overall scale.
Frequency
12.Each of the four loss accounts involved a payment that had been made before the member identified a problem or confirmed the change through a trusted channel. The cases arose in separate business dealings, as described by the members, rather than as four payments in one common transaction. This is evidence of recurrence within the group, not a rate of recurrence across businesses.
13.Members also described the need to verify payment details as a continuing operational burden. Such burdens can recur even when an attempted fraud is stopped. The two members who supplied evidence about attempted or disrupted incidents contribute to that account, but their experience is not counted as a completed loss in the table.
Consistency
14.The accounts share material features: a payment instruction or payee detail was altered or presented as altered; the business relied on a message associated with an existing commercial relationship; payment was made; and the fraud was identified after the payment or after a separate verification step. The specific communication channel, payment provider, discovery point and amount differed.
15.The pattern is consistent at the level of payment risk and response, not necessarily at the level of the fraud technique. This submission cannot establish that all cases involved compromised email accounts, that the same person or group was responsible, or that every case would have been prevented by the same control. The draft standard should address functional safeguards rather than presume a single method of attack.
Spread
16.The cases involve more than one commercial relationship and more than one payment channel, according to the members’ accounts. The evidence is confined to six UK-based members and does not establish spread across countries, sectors, institutions or payment systems. It is not a representative sample of UK firms.
17.The broader Council’s reports come from 35 countries. That geographic reach supports the Council’s mandate to examine cross-border business-payment risk, but it does not prove that the particular UK pattern in this submission is present in each country. The draft should therefore set a common minimum standard while allowing local law to determine eligibility, procedure and remedies.
Corroboration
18.Members described contemporaneous records, including invoices, payment confirmations, correspondence, call notes and complaint references. In some cases, a supplier’s confirmation that it had not changed payment details provided a separate check against the message. These are potential forms of corroboration; the Secretariat has not inspected originals or obtained confirmation from the institutions involved.
19.There is also corroboration at the level of the Council’s broader reporting process: the Fair Play Council has received 112 reports from 35 countries. That aggregate does not independently verify the four cases or establish that they share one cause. The evidence supports a cautious finding of a recurring, coherent member-reported pattern requiring a draft response and further consultation.
20.On the five tests taken together, the Secretariat considers that the evidence is sufficient to proceed to a draft fix, but not to make claims about national incidence, total losses, institutional fault or the effectiveness of any particular product. This is consistent with the Council’s process: a pattern test justifies consultation and standards development; it is not a finding of liability.
IV. Relevant UK protections and their limits
21.The UK Payment Systems Regulator’s APP reimbursement requirement took effect on 7 October 2024. It provides for reimbursement of qualifying authorized push payment fraud claims up to £85,000 per claim, covers consumers, micro-enterprises and charities, and allocates the cost equally between the sending and receiving payment service providers. International payments are excluded.2
22.The existence of this framework is relevant, but it should not be described as covering every business payment loss. The accounts in this submission have not been assessed by a regulator or legal adviser for eligibility. A business’s size, the payment route, the facts of the case and applicable exclusions may matter. Nor does the fact that a business approved a transfer resolve whether a particular claim qualifies for reimbursement.
23.Members’ concerns are practical as well as legal. They need to know whether a payee name matches the account details before approving a payment; how quickly a provider will act after a suspected fraud is reported; what information the provider will share about a recall; and what route is available when the payment or business falls outside the reimbursement framework. A standard can set expectations for these service steps without claiming to change the law.
24.The international exclusion is especially relevant to a global assembly. A small business may pay a supplier or contractor across a border, while the payment falls outside a domestic reimbursement regime. This submission does not seek to interpret the reach of any foreign law. It recommends that the draft make clear which protections are proposed as voluntary minimum practice and which are subject to local legal requirements.
V. Recommendations for the draft FP-001 Business Fraud Standard
25.The UK Fair Play Evidence Group recommends that the draft standard address the following functions. They are proposed as minimum practices for banks and payment providers, not as a claim that every payment can be guaranteed fraud-free.
Provide payee-name verification before payment. Where the payment system and available data permit, the payer should receive a clear result comparing the payee name supplied with the account information. The result should be understandable to a small-business user and should distinguish a match, a near match, a mismatch and an unavailable check. A warning should not be hidden in a generic terms screen or displayed only after authorization.
Make the check available at the point of decision. Verification should be offered within the ordinary payment journey, including for business users, and not depend on access to a specialist fraud team. If a check cannot be performed, the provider should say so before the payment is authorized. The standard should encourage payers to verify changed instructions through a previously known contact route, while recognizing that customer verification cannot replace provider safeguards.
Act promptly on recall requests. Providers should make an urgent reporting channel available, record the time a report is received, contact the receiving provider without avoidable delay and seek to freeze or return funds where possible. The payer should receive a reference number and a status update. The standard should define the operational steps and reporting of elapsed time, rather than promise that a recall will always succeed.
Give the customer a usable account of the response. A provider should explain what steps it took, when it took them, whether funds were located or returned, and what further information is needed. A customer should not have to repeat the same account to multiple teams without access to the prior report. The standard should provide a clear complaint or review route where the customer disputes the handling of the case.
Set out reimbursement decisions clearly. Where a statutory or contractual reimbursement framework applies, the provider should explain the decision, the applicable basis and the next review step in plain language. Where the framework does not apply, the provider should identify the reason and explain any alternative remedy or complaint path. The draft should not imply that a voluntary standard overrides legal exclusions.
Address cross-border payments and business users explicitly. Providers should identify when payee verification or recall support is unavailable because a payment is international or uses a different payment rail. The standard should encourage equivalent safeguards across supported routes and transparent notice where they cannot be provided. It should also distinguish small businesses from consumers when explaining eligibility, without making unsupported promises of reimbursement.
Publish comparable service information. Participating providers should report, in privacy-preserving aggregate form, the number of relevant reports, recall requests, funds returned, response times and reimbursement outcomes, with definitions that permit comparison. Data should distinguish domestic and international payments and eligible and ineligible claims. The Council should avoid drawing conclusions from raw totals without denominators and consistent categories.
26.The standard should avoid shifting the whole burden onto a small business to identify a sophisticated fraud. Practical advice to call a known supplier contact is useful, but it does not substitute for payee verification, rapid inter-provider action or a fair, intelligible process for resolving a claim. The draft should also avoid treating a delayed report as automatically decisive where the customer could not reasonably identify the fraud earlier.
27.The standard should use measurable commitments. During consultation, members should be asked whether proposed timing targets are achievable across payment rails and jurisdictions. Any final target should be supported by evidence and should distinguish the provider’s first action from the eventual recovery of funds, which may depend on the receiving institution and the movement of funds.
VI. Conclusion
28.The evidence in this submission is small and bounded. It does not establish the total scale of business-payment fraud, prove a shared cause, or determine that a particular provider acted unlawfully. It does show a repeated sequence in which a small business relied on a changed or misleading payment instruction, authorized a transfer, and sought help after discovering the problem. Members’ described records provide a basis for further examination, while the limits of verification are stated here.
29.The Secretariat submits that the five-part test is met sufficiently to support a draft standard and public consultation. The central recommendations are practical: verify payee names before authorization, make urgent recall procedures clear and prompt, explain reimbursement decisions, and report outcomes in a way that can be compared. These measures should be drafted as common expectations, with explicit recognition of statutory limits and cross-border gaps.
30.This submission is published with the consent of the six contributing members. It is intended to inform the Council’s work on FP-001 and does not constitute legal advice or a finding against any person or organization.
Sources
United Nations, Micro-, Small and Medium-sized Enterprises Day: https://www.un.org/en/observances/micro-small-medium-businesses-day
Payment Systems Regulator, APP fraud reimbursement protections: https://www.psr.org.uk/information-for-consumers/app-fraud-reimbursement-protections/
Notes and sources
Sources
This document has no standing until adopted under the Founders Charter. Reseated Councils is not affiliated with the United Nations.