Payment scams in the trades: when the details don't add up
03 November 2026Posted by:
Viveka Alvestrand
Content Marketing Manager, Trade Direct Insurance
An unexpected refund, changed supplier bank details or a message that looks like part of a regular job. Payment scams don't always start with something obviously suspicious. We look at how some common ones work and the details that can make a genuine-looking request worth a closer look.
Payment scams aren't always obvious
An invoice arrives from a supplier you've used before. The amount is right, the job reference matches and the message sounds like them. There's just one difference: their bank details have changed.
It could be a genuine update. Or it could be an attempt to redirect your payment to a fraudster.
That's the tricky thing about payment scams. They don't necessarily involve an outlandish story or an offer that's too good to be true.
Sometimes, they look remarkably like the everyday messages and transactions that come with running a business.
Payment scams can take several forms, from fake invoices and fraudulent refund requests to messages impersonating genuine contacts. They're not unique to the trades, but they're relevant wherever quotes, orders and payments are part of the working day.
And with so much business communication now happening on phones, it's worth knowing what some of these scams actually look like.
How invoice fraud typically works
Invoice fraud involves criminals tricking someone into paying a fake invoice or sending a genuine payment to the wrong bank account.
They might impersonate a supplier, gain access to an email conversation or send a convincing-looking invoice containing different payment details.
The amount being requested may be exactly what you're expecting to pay. The supplier's name and the work involved could also be correct.
It's the destination of the money that's changed.
This is a recognised issue within construction. In March 2026, the National Crime Agency (NCA) and National Federation of Builders launched a campaign highlighting invoice fraud and how criminals exploit genuine business communications.
The campaign focused on the wider construction industry, rather than specifically on sole traders and smaller trade businesses. But the method it describes isn't limited to companies with large accounts departments.
More recently, figures published by Report Fraud in September 2026 revealed that businesses and individuals reported losing over £101 million to payment diversion fraud during the 2025/26 financial year.
That's a figure across the wider economy, not just construction, but it shows why fraudulent changes to payment details are being taken seriously.
What happens in an overpayment scam?
Here's another scenario.
You've quoted £1,000 for a job, but the customer sends a cheque for £3,500. They explain they've made a mistake and ask you to return the extra £2,500, perhaps by transferring it to someone collecting materials.
The problem? The cheque is fraudulent.
Although the money may initially appear in your account, the cheque can subsequently be returned unpaid. Any separate transfer you've made isn't automatically reversed with it.
This is known as an overpayment cheque scam, and it's documented in Santander's business fraud guidance.
Admittedly, cheques aren't exactly the payment method of choice for modern business. But the scam illustrates a wider point about unexpected changes to financial arrangements.
An apparently helpful request to correct a payment can involve an entirely separate transaction, with consequences that aren't obvious from the original message.
Phishing and impersonation: when familiar names aren't what they seem
Not every scam begins with a payment request.
Some start with an email or text that appears to come from someone familiar. It could be a customer sharing updated information, a supplier sending an invoice or a service provider asking you to confirm account details.
The message might include a link to view a document or sign in to an account.
But the link could lead to a fake website designed to collect passwords or financial information. An attachment may also contain malicious software.
According to the National Cyber Security Centre (NCSC), phishing scams can arrive through emails, texts and phone calls. Criminals may impersonate trusted contacts or organisations to make their messages appear genuine.
And the old giveaway of poor spelling and questionable grammar isn't always present. A fraudulent message can look polished and professional.
The name displayed at the top of a message is only part of the picture. The email address, website link and nature of the request can tell a different story.
When business admin happens between everything else
There's another consideration that makes this subject particularly relevant to working life on site.
A lot of business communication now happens on the move.
A customer sends a WhatsApp message. A merchant emails an invoice. There's a missed call about tomorrow's job, followed by a notification about a delivery.
Much of it can be dealt with from a phone, without going back to a desk.
That's convenient, but a notification doesn't always give you the full picture. An email preview may show the sender's name without the full address. Payment details could be buried in an attachment or further down a conversation.
And when something arrives in the middle of another task, there's a difference between reading enough to understand the request and having the opportunity to examine its details.
It's not about being careless. A convincing message can be difficult to distinguish from a genuine one, particularly when it refers to work or people you already know.
Some messages are easier to assess when there's time to read the whole conversation, away from the demands of the job in progress.
What makes a payment request worth a closer look?
The different scams have something in common. They introduce a change to an otherwise familiar transaction or conversation.
A few examples include:
- Different bank details: A supplier or customer introduces new payment information that wasn't part of the original arrangement.
- An unexpected overpayment: Someone sends more money than agreed and asks for the difference to be transferred elsewhere.
- An unfamiliar link or attachment: A message asks for account information or directs you to a website you weren't expecting to use.
- A sudden sense of urgency: Payment instructions change alongside pressure to act quickly, perhaps because a delivery or booking supposedly depends on it.
None of these details automatically proves that something is fraudulent. Genuine businesses change bank accounts, customers make payment mistakes and urgent requests are sometimes legitimate.
The distinction is whether the request can be independently verified.
The NCA's construction fraud campaign highlights checking changes to payment details with a genuine supplier, using contact information already held rather than relying on the details in a new message.
For further information, the NCSC also provides guidance on business payment fraud, including how fraudulent requests can be recognised and information about reporting suspected fraud.
A little more attention to the details
A changed account number. An unexpected refund. A familiar name attached to an unfamiliar link.
On their own, these can look like fairly ordinary pieces of business admin. It's the context around them that makes the difference.
Keeping track of agreed payment arrangements and recognising when something has changed can make unusual requests easier to identify.
After all, the invoice might be genuine, the amount might be correct and the supplier might be someone you've worked with for years.
But that doesn't necessarily mean the message asking for payment came from them.
About the Author
Viveka Alvestrand
Content Marketing Manager, Trade Direct Insurance
Viveka Alvestrand is an experienced content and digital marketing professional with a background in editorial strategy, brand storytelling and multi-channel communications.
Trade Direct is authorised and regulated by the Financial Conduct Authority. The company is a leading UK independent broker providing a wide range of policies to tradesmen and construction workers.
This note is not intended to give legal or financial advice, and, accordingly, it should not be relied upon for such or regarded as a comprehensive statement of the law and/or market practice in this area. In preparing this note we have relied on information sourced from third parties and we make no claims as to the completeness or accuracy of the information contained herein. You should not act upon information in this bulletin nor determine not to act, without first seeking specific legal and/or specialist advice. We and our officers, employees or agents shall not be responsible for any loss whatsoever arising from the recipient’s reliance upon any information we provide herein and exclude liability for the content to fullest extent permitted by law.