Email Fraud Protection for Accountants: Invoice Fraud, HMRC Phishing and DMARC

Email fraud protection for accountants rests on three things: lock down your own domain with SPF, DKIM and an enforcing DMARC policy so criminals can't send fake invoices as you; protect every mailbox and HMRC agent login with multi-factor authentication; and agree a verification routine with clients so no bank detail change is ever acted on from an email alone.

Accountancy practices are attractive targets for two reasons. First, they handle payments: fee invoices going out, client money and payroll runs, and sometimes payments made on clients' behalf. Second, they hold the keys to HMRC: agent services accounts, client authorisations and a constant flow of tax correspondence, which gives criminals a ready-made disguise. This guide covers the main types of email fraud aimed at practices and their clients, and the technical and human controls that stop them.

AI Automation for Accounting Firms, Explained Step by Step · 3:03 Subscribe

The threats facing accountancy practices

Invoice and payment diversion fraud

This is the classic one. A criminal either compromises an email account or imitates one, then sends a convincing message saying bank details have changed. UK Finance calls it invoice and mandate fraud. Its Annual Fraud Report 2026 puts losses from invoice and mandate scams at £41.3 million in 2025, and says 68 per cent of those losses (£28 million) were on non-personal or business accounts, because businesses make genuine high-value payments regularly, making a fraudulent one harder to spot.

For a practice, it can strike in several directions:

• Your firm is impersonated. Clients receive a fake fee invoice or a "we've changed banks" email that appears to come from you.
• A client is impersonated. You receive instructions to pay a refund, a payroll run or a supplier into a new account.
• A client's supplier is impersonated. If you run payments for clients, a fake supplier email can divert a genuine invoice payment.

Fake HMRC emails

Tax correspondence is a perfect cover story. Criminals send fake HMRC messages about penalties, rebates, Making Tax Digital, anti-money laundering registration or agent account problems, designed to steal Government Gateway or agent credentials or to install malware.

HMRC's guidance on reporting scams says it will never send an email, text, app message or phone call that tells you about a tax rebate or penalty, or asks for your personal or payment information. Suspicious emails should be forwarded to phishing@hmrc.gov.uk and texts to 60599.

HMRC has also warned agents specifically. ICAEW's summary of how to keep HMRC agent account details safe reports that HMRC described agent accounts as "often a target for fraudsters" and may suspend a compromised account without notice. Its advice includes keeping software and antivirus updated, using strong passwords, treating unexpected links and attachments with caution, and reporting suspicious agent account activity to HMRC's online services team straight away.

Account takeover

Many frauds start with a single compromised mailbox: a member of staff enters their password on a fake Microsoft 365 login page, or a client's personal email is hacked. The criminal then reads the inbox quietly, learns who pays whom and when, and strikes at the right moment with a reply in an existing thread. Because the email comes from a genuine account, it looks entirely normal.

The technical layer: SPF, DKIM and DMARC

These three DNS records tell receiving mail servers whether email claiming to be from your domain is genuine.

Without DMARC, or with DMARC at p=none, anyone can send email that shows your exact domain in the From line. At p=reject, receiving servers that honour DMARC will block those fakes before your client sees them.

Rolling it out in a practice

1. List every system that sends email as your domain. Microsoft 365 or Google Workspace, your practice management software, accounting and payroll platforms, e-signature, client portal, proposal tools and newsletter software.
2. Fix SPF so every legitimate sender is included and you stay under the 10 DNS lookup limit. Check it with the free SPF checker.
3. Enable DKIM for each platform. Most give you DNS records to add. Confirm each one signs correctly with a test email.
4. Publish DMARC at p=none with a reporting address, using the DMARC record generator.
5. Review reports for a few weeks. Our guide to reading DMARC reports explains what to look for, such as a payroll platform you forgot about.
6. Move to quarantine, then reject, once genuine senders pass. Confirm the live policy with the DMARC checker.
7. Protect unused domains (old practice names, domains from mergers) with v=spf1 -all and a p=reject DMARC record.

The NCSC's email security and anti-spoofing guidance recommends the same staged approach. For a full walkthrough, see our email authentication checklist.

What DMARC won't stop

Be clear about the limits so nobody gets complacent:

• Lookalike domains, such as smithaccountants.co or srnithaccountants.co.uk, are separate domains the criminal controls. They can pass every check.
• Compromised genuine mailboxes, yours or your clients', send authentic mail.
• Free webmail accounts using your firm's name in the display name, such as "Smith & Co Accountants smithco.accounts@gmail.com".

That's why the next two layers matter as much as the DNS records.

Locking down accounts

• Multi-factor authentication everywhere: every mailbox, the HMRC agent services account and Government Gateway logins, cloud accounting platforms, payroll software and the practice management system. Prefer an authenticator app or passkeys to text messages where possible.
• Watch for MFA prompts you didn't trigger. An unexpected prompt can mean someone already has the password. Staff should deny it and report it.
• Disable legacy email protocols that bypass MFA.
• Block automatic forwarding to external addresses and review inbox rules regularly. Criminals often add rules that hide replies or forward anything mentioning "invoice" or "payment".
• Be careful with remote access tools. HMRC has warned agents that criminals trick them into installing legitimate remote access software, which antivirus may not flag. Only install software your IT provider has approved.
• Consider Cyber Essentials. It covers the technical basics, and HMRC's advice to agents points to NCSC guidance, including Cyber Essentials certification.

The process layer: client verification

Technology reduces the number of fake emails that get through. Process stops the ones that do.

Set expectations from day one

• Put your bank details in the engagement letter and state clearly that they won't change by email.
• Add a short line to invoices and your email signature: "We will never change our bank details by email. If you receive a message saying otherwise, call us on the number on our website."
• Publish the same warning on your website's contact or payments page.

Verify every change, every time

When anyone asks to change bank details, whether a client, a supplier or a member of staff for payroll:

1. Don't reply to the email or use any phone number in it.
2. Call the person on a number you already hold from the start of the relationship.
3. Ask an open question to confirm identity, rather than reading out details for them to agree with.
4. Record who checked, how and when.
5. For large payments, use a small test payment and confirm receipt by phone first.
6. Require a second person to approve any change to stored bank details.

Confirmation of Payee checks can flag a name mismatch, but they aren't a substitute for a call.

Don't confuse this with anti-money laundering checks

Customer due diligence under the Money Laundering Regulations confirms who your client is when you take them on. Payment verification confirms that a specific instruction really came from them. You need both. A client who passed ID checks last year can still have their email hacked today.

Help your clients too

Many of your clients are small businesses with no IT team. A short briefing in your newsletter, or a one-page guide with their year-end pack, on DMARC, MFA and calling to verify bank changes is genuinely valuable. It also protects you: if a client is fooled into paying a fake invoice in your name, the relationship suffers even if your systems were sound.

Staff awareness

Short, regular sessions work better than an annual lecture. Cover:

• How to check the real sender address, not just the display name.
• Common HMRC scam themes, and the rule that HMRC doesn't email about rebates or penalties.
• How to report a suspicious email quickly, with no blame for asking.
• What to do if they've clicked a link or entered a password.

When something looks off, paste the message headers into the free email header analyser to see which servers it really passed through and whether SPF, DKIM and DMARC passed.

A checklist for practices

1. SPF, DKIM and DMARC set up for every sending platform, with DMARC at quarantine or reject.
2. Old and unused domains protected with -all SPF and p=reject DMARC.
3. MFA on email, HMRC agent accounts, accounting and payroll platforms.
4. External auto-forwarding blocked, inbox rules reviewed monthly.
5. Bank details in the engagement letter with a "never by email" warning.
6. Every bank detail change verified by phone on a known number and recorded.
7. Two-person approval for changes to stored payee details.
8. Phishing awareness sessions at least twice a year.
9. A response plan covering your bank, the police, HMRC, the ICO and your insurer.

If you've been targeted

1. Call your bank immediately if money has gone, to try to recall it.
2. Secure the affected account: change passwords, sign out all sessions, remove unknown inbox rules and check MFA.
3. Report fraud to the police through Report Fraud, which replaced Action Fraud from December 2025.
4. If agent credentials may be compromised, contact HMRC's online services helpdesk.
5. Consider whether it's a personal data breach that must be reported to the ICO within 72 hours.
6. Tell affected clients quickly and clearly what to look out for.

Our page of free tools for accountants and finance firms groups the email checks above with browser-based PDF tools that don't upload client documents. If routine work like chasing records and onboarding new clients is taking up partner time, Make It Flow builds automations for accounting firms, with accountants staying in charge of advice, approvals and anything regulated.

FAQ

What is invoice fraud?

Invoice fraud, which UK Finance calls invoice and mandate fraud, is when criminals pretend to be a supplier or service provider and trick someone into paying a genuine bill into the criminal's account. It usually involves an email saying bank details have changed, sent from a hacked mailbox, a spoofed domain or a lookalike address.

How can accountants stop fake invoices being sent in their name?

Publish SPF, DKIM and DMARC for your domain and move DMARC to quarantine or reject, so receiving servers block email that fakes your exact address. Then tell clients in your engagement letter, invoices and email signature that your bank details won't change by email, and ask them to call a known number before paying any changed details.

How do I know if an email from HMRC is real?

HMRC says it will never email, text or call to tell you about a rebate or penalty or to ask for personal or payment information. HMRC has also said genuine emails come from addresses ending in gov.uk, but those can be imitated, so log in to your account directly rather than clicking links. Forward suspicious emails to phishing@hmrc.gov.uk.

Does DMARC protect against all email fraud?

No. DMARC stops criminals using your exact domain, which is a common tactic. It doesn't stop lookalike domains, free webmail accounts using your firm's name, or emails from a hacked genuine mailbox. Combine it with multi-factor authentication, external forwarding blocks and a strict phone verification routine for any change of bank details.

What should an accountant do if a client paid a fraudster?

Ask the client to contact their bank immediately, as quick action gives the best chance of recovering funds. Check whether your own mailbox or domain was involved, secure any compromised accounts, report it to the police through Report Fraud, notify your insurer and consider whether a personal data breach needs reporting to the ICO.

Is multi-factor authentication required on HMRC agent accounts?

HMRC uses additional verification on its online services, and it has warned that agent accounts are often targeted by fraudsters and may be suspended without notice if compromised. Use the strongest sign-in options available, keep recovery details current, watch for authentication prompts you didn't request and report suspicious activity to HMRC's online services team.