Two in five businesses fall victim to invoice fraud, with losses averaging £270,000
New research from Ivalua, the enterprise AI platform for procurement, reveals that 40% of organisations experienced invoice fraud in the past 12 months. Organisations that lost money report an average cost of £270,000, and almost a third of those affected (29%) lost £368,000 or more.
Compounding the damage, invoice fraud takes an average of nine days to identify, while just 27% of organisations catch it on the same day. One in five organisations required two weeks or longer to identify fraud, by which point the money has usually long left the business.
“Fraudsters aren’t breaking into businesses, they’re walking straight in through gaps in supplier records,” says Stephen Carter, payments expert at Ivalua. “With AI lowering the barrier to entry, it has never been easier for an internal or external fraudster to look legitimate. Ghost vendors, hijacked bank details and impersonated suppliers are no longer opportunistic one-offs, but systematic attacks on crucial areas of the payment process. At an average of £270,000 per incident, invoice fraud is not a back-office nuisance, and it must be treated as a boardroom priority.”
Invoice fraud shows no sign of easing, and those already hit expect a challenging year ahead. Fraudulent changes to supplier bank details top victims’ concerns (41%), closely followed by duplicate invoicing and compromised supplier email accounts (both 39%). Ghost vendors, where a fake supplier record is created to add invoices into the payment system, worry almost a third (32%).
Despite these concerns, just a quarter (25%) of organisations confirm they carry out mostly automated supplier checks with a standardised workflow and audit trail. Nearly one in five (19%) still vet new suppliers by hand through email, documents and spreadsheets. A further 6% either have no consistent verification process or cannot verify suppliers at all.
“Closing the door on invoice fraud starts with the supplier record itself. A single, verified record for every vendor leaves ghost vendors nowhere to hide,” continues Carter. “Organisations need automated verification and payment checks with a full audit trail, with human validation reserved for sensitive changes like bank details. That way, red flags surface before money moves, not nine days after. Get this right, and fraud detection stops being forensics and becomes prevention.”