The Half-Hour Before Christmas: Auditing the Money Trail Against Festive Invoice Fraud
December is not merely busy for UK SMEs. It is structurally risky. Payment runs are compressed, senior approvers disappear on leave, suppliers chase overdue invoices before shutting for the holidays, and finance teams work with one eye on the clock. Fraudsters know this. They do not need to break into a bank account; they only need to persuade someone with payment authority to send money to the wrong one.
Invoice diversion, often wrapped up in business email compromise, thrives on exactly that mix of urgency and reduced oversight. The ploy is familiar but effective: a supplier email arrives with revised bank details, a plausible excuse about an audit or a change of bank, and a request to update the payee before the next run. In the festive window, the person who would normally challenge the request may be on a train home, and the person covering may not know the supplier.
Why December is peak season for payment diversion
The festive period brings three conditions together. First, year-end pressure encourages speed: invoices that must be settled before the holiday, bonuses to process, and suppliers threatening to pause work in January. Second, staffing thins out. Approvals that usually pass through two or three pairs of eyes can end up with a single manager holding the fort. Third, normal verification habits slip. A call-back that would take five minutes in October feels like an unnecessary delay on 23 December.
Criminals also exploit the cloak of closure. A fake email sent just before a supplier's Christmas shutdown may not be challenged because the real supplier is not answering its phones. A request to change bank details on 27 December may sit unchecked until January, by which time the money has moved through mule accounts.
The answer is not to cancel Christmas or freeze all payments. It is to impose a short, disciplined audit of money movement before the slowdown begins. Thirty minutes, done properly, is enough to expose the weakest points in a typical SME payment process.
The 30-minute money-movement audit
This is not a full fraud risk assessment. It is a practical control check for an owner, finance director or office manager who wants to close the most obvious gaps before the Christmas break. Block out half an hour, bring the supplier list and the bank mandate, and work through five areas.
Minutes 0-5: Pull the supplier master list
Ask for a current list of supplier payees, including sort codes and account numbers, and find out who has changed bank details in the last 90 days. Any change is a prompt for a separate check. Look for patterns: several changes in a short period, new accounts with unfamiliar banks, or payees whose contact details have also changed. If the finance system allows it, run an aged report of pending bank-detail amendments. The goal is not to approve anything on the spot; it is to identify what needs verification.
Minutes 5-15: Rebuild the call-back rule
Bank-detail changes should never be confirmed by email alone. The safest rule is simple: ring the supplier on a number already held in your records, not the number on the new invoice or email. If the only available number comes from the suspicious message, find an independent source, such as a contract, a previous statement or the supplier's website typed manually into a browser.
During the audit, test the rule on one recent change. Who made the call? Which number was used? Was the change approved by someone senior? If the answer is vague, the process is relying on trust rather than control. For the festive period, set a hard cut-off: no bank-detail changes after a specified date without director-level sign-off and a documented call-back.
Minutes 15-20: Lock down approval workflows
Find out who can set up a new payee and who can approve a payment. In many SMEs, the same person can do both, which is convenient until it is exploited. Where possible, separate the two. Require dual approval for new payees and for payments above a modest threshold. Check that temporary festive cover does not accidentally grant wider authority than intended. If the finance system supports payment templates, remove unused or duplicate supplier records, which are a common hiding place for diverted payments.
Minutes 20-25: Brief the people who pay
Staff need a short, clear instruction rather than a lengthy policy document. Tell them that any request to change bank details is treated as suspicious until verified by phone. Explain that urgent language, unusual formatting, a changed email signature or a reply-to address that differs from the sender are warning signs. Ask them to forward suspicious messages to a named person rather than reply. If the business uses a messaging group or intranet, post the rule there before the Christmas rota starts.
Minutes 25-30: Check the safety net
Finally, confirm what happens if money is sent to the wrong account. UK banks and payment firms operate under fraud reimbursement rules for authorised push payment scams, but reimbursement is not automatic. Claims can be refused where the customer ignored warnings or failed to carry out reasonable checks. Speak to the bank relationship manager about its recall process and the evidence it expects. Check whether the business has crime or fraud insurance, what the notification window is, and whether the policy covers invoice diversion or only external theft. A policy that requires immediate notification is of little use if the discovery is left until the January accounts review.
A small control that travels well
The festive fraud window is narrow, but it is wide enough for a single diverted payment to cause real damage. The strongest defence is not a new software platform or a lengthy consultant report. It is a repeatable habit: verify bank changes by phone, separate payee set-up from payment approval, and tell staff that urgency is a reason to slow down, not speed up.
Thirty minutes before the Christmas slowdown is a modest investment. It also leaves a process that works in January, when the next fake invoice arrives.
