How to check a supplier before you pay an invoice

Why check a supplier before paying?

You check a supplier before paying because the most expensive invoice fraud does not involve a fake company: it involves a real supplier and someone else's bank account. In invoice or mandate fraud, a criminal poses as a business you deal with and sends new or amended bank details, often from a hacked or spoofed email account.

That changes what a check has to prove. Companies House can show that the company exists and is still trading on paper. It cannot show who owns a bank account. A safe payment process needs both: a register check on the company and an independent check on the payment details.

Key facts:

• Since 7 October 2024, payment firms must reimburse victims of authorised push payment scams up to £85,000, but only individuals, micro-enterprises and charities are covered (Payment Systems Regulator).
• A micro-enterprise for this purpose employs fewer than 10 people and has annual turnover or balance sheet total not above €2 million (Payment Systems Regulator).
• Since 4 March 2024, a company cannot use a PO Box as its registered office and must have an "appropriate address" (GOV.UK).
• On 1 October 2026, 27,748 companies had their registered office at the Companies House default address in Cardiff, and 83% of them were under a strike-off proposal (UK Company Data, strike-off study).

Step 1: confirm the company on Companies House

The first check is that the legal entity on the invoice exists, is Active and matches what you were told. Search the register by company number rather than by name, because names can differ from a real company by one word.

On the company overview, confirm:

1. Status is "Active", not "Dissolved", "Liquidation", "In Administration" or "Active - Proposal to Strike off".
2. Name matches exactly, including the ending (Limited, Ltd, LLP, plc).
3. Incorporation date fits the story. A company formed last month that claims ten years of trading needs an explanation.
4. Registered office is a real business address, not the Companies House default address, PO Box 4385, Cardiff CF14 8LH.
5. Directors include the person you have been dealing with, if they claim to be one.

Our guide on how to check a UK company covers the full nine checks, including accounts and charges. For a new supplier, the five above take two minutes. The company number format is explained in the glossary.

Step 2: match the invoice to the register

A genuine invoice from a UK company should agree with the public record on every detail it shows. Any mismatch is a reason to stop and ask before money moves.

HMRC's VAT checker confirms whether a UK VAT number is valid and shows the name and address it is registered to. It cannot be searched by business name, so you need the number from the invoice.

Step 3: use Confirmation of Payee

Confirmation of Payee checks the name you type against the name on the receiving account before you send the payment. The Payment Systems Regulator directed around 400 payment firms to offer it, so most UK business banking platforms now run the check when you add or change a payee.

The result is one of four answers:

• Match. The name and account type agree with the account.
• Close match. The name or account type (personal or business) is nearly right; your bank shows the actual name.
• No match. The name does not match the account.
• Unable to check. The receiving bank could not confirm, for example because it does not take part.

When paying a company, select a business account and enter the full registered name. A close match showing a personal name, or a no match, should stop the payment until you have spoken to the supplier on a known number.

Step 4: verify bank details by phone

Any request to change bank details should be verified by calling the supplier on a phone number you already hold, never one taken from the email or letter that asked for the change. Take Five, the national awareness campaign run by UK Finance, advises businesses to treat such requests with suspicion because companies rarely change their bank details.

A call-back routine that works:

1. Freeze the change. Do not update the supplier record until verification is complete.
2. Call a number from your own records, a signed contract or the supplier's long-standing website, and ask for someone you have dealt with before.
3. Ask them to confirm the new sort code and account number to you, rather than reading the details out yourself.
4. Record who confirmed it, when and on which number.
5. For the first payment to new details, send a small amount and ask the supplier to confirm receipt, as Take Five suggests.
6. Send a remittance or payment confirmation to the supplier's known contact once the invoice is paid.

Build the checks into your payment process

One person's vigilance is not a control; a written process is. Fraudsters target the moment when someone is busy, new or under pressure to pay quickly.

• Limit who can create suppliers or change bank details, and require a second person to approve any change.
• Keep the call-back record with the supplier file.
• Re-run the Companies House check for suppliers you have not paid for six months or more.
• Treat urgency, secrecy and "our bank has changed" in the same message as one combined red flag.
• Watch for a supplier whose status changes. A company that becomes "Active - Proposal to Strike off" or enters liquidation after you onboarded it should be reviewed before the next payment.

To see a supplier's status, filing deadlines and registered office in one view, search it on our accounts page. Our list of Companies House red flags explains what each warning sign means.

What if you have already paid?

Call your bank immediately using the number on the back of your card or on its official website, because the chance of recovering money falls with every hour. Your bank contacts the receiving bank and can sometimes freeze funds still in the account.

Then report the fraud to Report Fraud, the national service that replaced Action Fraud in England, Wales and Northern Ireland, at reportfraud.police.uk or on 0300 123 2040. In Scotland, report it to Police Scotland. Tell the genuine supplier too: their email account may have been compromised, and other customers may be targeted.

Reimbursement depends on who you are. Individuals, micro-enterprises and charities paying by Faster Payments or CHAPS are covered by the mandatory reimbursement rules up to £85,000 for payments made on or after 7 October 2024. Larger businesses are outside the scheme and depend on their bank's own approach, which is why prevention matters more for them.

Sources

1. APP fraud reimbursement protections, Payment Systems Regulator, accessed 17 October 2026.
2. Specific Direction 17 on expanding Confirmation of Payee, Payment Systems Regulator, accessed 17 October 2026.
3. Invoice and mandate fraud: protect your business, Take Five to Stop Fraud (UK Finance), accessed 17 October 2026.
4. Check a UK VAT number, GOV.UK, accessed 17 October 2026.
5. Set up a private limited company: rules for registered office addresses and email addresses, GOV.UK, accessed 17 October 2026.
6. Report Fraud service goes live, Report Fraud, City of London Police, accessed 17 October 2026.

FAQ

How do I check a supplier is legitimate in the UK?

Search the company number on the Companies House register and confirm the status is Active, the name matches the invoice exactly and the registered office is a real business address. Check the VAT number with HMRC's online checker. Then confirm the bank account with Confirmation of Payee and, for any new or changed bank details, call the supplier on a number you already hold.

What is mandate fraud?

Mandate fraud, also called invoice redirection or payment diversion fraud, is when a criminal poses as a supplier you already pay and tells you their bank details have changed. The new account belongs to the criminal. The supplier is usually genuine, so a Companies House check alone will not catch it; verifying the change by phone on a known number will.

Does Confirmation of Payee stop all invoice fraud?

No. Confirmation of Payee checks that the name you enter matches the name on the receiving account. It helps when a fraudster's account is in a different name, but it cannot help if you enter the name the fraudster tells you, or if the receiving bank cannot be checked. Treat it as one control alongside a call-back on a known number.

Will my bank refund an invoice fraud payment?

It depends on who you are. Since 7 October 2024, payment firms must reimburse authorised push payment scam victims up to £85,000, but only individuals, micro-enterprises with fewer than 10 staff and turnover or balance sheet up to €2 million, and charities are covered. Larger businesses fall outside the mandatory scheme, so report the payment to your bank immediately and ask what it can recover.

Sources: Companies House register and accounts data (Open Government Licence v3.0), legislation.gov.uk and GOV.UK guidance where linked. This page is general information, not legal, tax or credit advice. Spotted an error? Email info@globalmindsetmarketing.co.uk.