Mandate Fraud

Mandate fraud targets businesses, charities, and public sector organisations by impersonating a known supplier, contractor, or employee and requesting a change to bank account details on file. The fraudster may send a convincing email from a spoofed or compromised address, or occasionally call posing as the payee. Once the account details are updated in the victim organisation's system, all subsequent legitimate payments go to the fraudster's account.

The fraud can go undetected for months if payments are regular and neither party actively reconciles invoices with bank statements. By the time the genuine supplier flags non-payment, the fraudster has withdrawn the funds and the accounts are typically empty.

Mandate fraud is closely related to business email compromise (BEC) and is sometimes called 'payment diversion fraud'. Prevention requires strict change-management procedures: any request to update account details should be verified by calling the payee on a known, independently looked-up telephone number — never the number given in the change request — and confirmed in writing through a secondary channel.