£101 Million Lost to Payment Diversion Fraud in a Year

TL;DR: On 28 September 2026, City of London Police reported that £101 million was stolen through payment diversion fraud in 2025/26. There were 3,657 reports, a 3% rise. Invoice fraud made up 22% of cases (813 reports), and 63% of victims were individuals.

👉 Check my digital footprint — free 30-second check →

What happened

In its warning, City of London Police explained that criminals either compromise an email account or impersonate a genuine organisation, then ask for payment details to be changed. The money then goes to an account they control.

Individuals made up 63% of victims and organisations 35%, and people aged 30 to 39 were most affected. Construction was the business sector with the most reports. Hotels and restaurants are targeted through online booking platforms, and pension fund accounts are an emerging target.

Red flags

An email or message saying bank details have changed.
A sender address that looks nearly right, or a real address that has been hacked.
Urgency around paying an invoice, deposit or booking.

How to protect yourself

Confirm any change by phoning a number you already hold, never one in the message. Businesses can send a small test payment first and restrict payment authority to designated staff. Our pages on business email compromise statistics for 2026, how to reverse a wire transfer scam and how to recover wire scam money explain how these transfers work and how recovery is attempted.

Who is being targeted

The figures challenge the idea that this is only a corporate problem. Nearly two-thirds of victims were individuals, which can include people paying a solicitor, builder or deposit after an email arrives with new account details. Among businesses, construction recorded the most reports, while hotels and restaurants are approached through online booking platforms. Pension fund accounts are described as an emerging target. The common thread is a message that arrives at exactly the moment a payment is due, so build a habit of verifying before any transfer. Keeping a record of who you normally pay, and the account details they gave you originally, makes a changed set of details easier to question. Small firms and households alike benefit from a second pair of eyes on any large payment, especially one agreed by email alone.

Where to report

Tell your bank immediately, then report to Report Fraud (Action Fraud) (reportfraud.police.uk or 0300 123 2040). See how to report a scam to Action Fraud for what to include.

Frequently Asked Questions

How much was lost?

£101 million in the 2025/26 financial year, across 3,657 reports.

Who is affected?

63% of victims were individuals and 35% organisations; the 30 to 39 age group was most affected.

How does the fraud work?

Criminals compromise an email account or impersonate an organisation and ask for payment details to be changed.

How do I check a request?

Confirm any change by phoning a number you already hold, and consider a test payment first.

£101 Million Stolen Through Payment Diversion Fraud as Police Warn Businesses and Public