Dutiful

All guides

Before paying an invoice: check the company and confirm changed bank details

UK police fraud guidance stresses checking changed payment instructions with a trusted known contact. If a supplier asks you to change bank details, confirm the change through a contact you already trust, using contact details you already hold or verify independently - not the details in the change request. This guide explains that check, then shows where a company registry check adds context and where it does not.

Call-back checks in the cited guidance

Payment diversion fraud (also called mandate fraud or business email compromise) works by impersonating a known supplier and asking for payments to go to a new bank account. Action Fraud's supplier guidance describes the pattern: a fraudster assumes the identity of a known supplier and requests that regular payments be diverted into a different account, sometimes after months of building the relationship.

One recommended control in that guidance is a single point of contact (SPOC): establish one named contact with each regular supplier, reached through the supplier's verified company switchboard, and run every change of payment details past that contact. Two details in this advice matter:

  • Use contact details you already hold or verify independently. In a March 2022 poll of 515 business owners and decision makers cited by Barclays, 14% said they called the number on the invoice to confirm - which could connect them to the fraudster if that number has been substituted.
  • Treat urgency as a warning sign. The guidance lists red flags: a request to change an existing supplier's bank details or to set up a new supplier, pressure to process a large or unusual payment urgently, and email language or addresses inconsistent with the genuine sender.

Action Fraud reported 4,600 payment diversion cases in the year to September 2021, with average individual losses around £30,000.

This Action Fraud guidance is older published guidance; the final section below gives the current reporting routes.

Where a registry check adds context

A registry check answers a different question: does this legal entity exist, and do its public records match what you have been told? The same supplier guidance includes checking that Companies House records are consistent with the supplier's claims, alongside searching the supplier's name with terms such as "scam" or "complaints" and asking industry contacts for references.

Depending on the country and registry, public records may show:

  • Registered name, number and registered address.
  • The registry's recorded status and filing information, where published.
  • Officers and ownership information, where the registry supports it.

What a registry check does not establish:

  • Whether a bank account belongs to the company. The registry sources described here do not authenticate the supplier's payment instructions.
  • Whether an invoice is genuine. A real, active company can be impersonated; the invoice in front of you may have nothing to do with it.
  • Financial health or reliability. Existence and filing compliance are not creditworthiness.

Where Dutiful fits

Dutiful's Company Report brings together supported registry facts, a company-level, name-only OFAC SDN and UK Sanctions List screen, and a news and web scan, with sources and stated limits. Registry fields vary by country; officers, owners and filings are included only where supported. US coverage is limited to SEC-reporting entities; Canada coverage is limited to federal corporations under the Canada Business Corporations Act (CBCA). EU and UN sanctions lists are not screened. You can check coverage for a company name and country for free before paying.

A report like this is one input to your own checks. It does not verify bank details, authenticate invoices, or detect fraud, and it is not a credit report, compliance certificate or professional advice. The contact check described above does not require buying a report.

If you suspect you have already paid a fraudster

The 2021 Action Fraud guidance advises contacting your bank immediately if you think you have paid a fraudster. For current reporting routes, Report Fraud covers England, Wales and Northern Ireland online or on 0300 123 2040; if you live in Scotland or the crime happened there, contact Police Scotland on 101. Reporting does not guarantee recovery.

Sources

Related Dutiful guides: United Kingdom company check, OFAC SDN check

Run the free coverage check · See a sample report