Independent UK care editorial Evidence · leadership · action

AboutMethodologyContact
CARE CIRCLENETWORK

See the change. Examine the evidence.
Understand what it means for care.

Editorial intelligenceCare outlook 2026/27
Menu

Sponsored programme with Acrisure

November continuation / 08 / Payment fraud & financial control

Payment fraud in care: follow the instruction before the money moves

A convincing payment request can travel through a familiar inbox and still require an independent check. The provider’s response needs to join finance controls, staff confidence, technical support and the relevant insurance questions.

Nominated Care & Commercial Insurance PartnerExplore Acrisure’s expertise
Care Circle Network Editorial DeskPublished 7 November 2026 · Reviewed 7 November 20266 min read · November 2026 coverage
Provider outcomeThe supplier-change and payment-authority review
Practical supportReview and downloadable working record
Evidence and geographyUK provider discussion. England care guidance and each professional source retain their stated scope.
In this feature

The story so farOctober: the care contract

A familiar supplier’s invoice arrives with new bank details. The service is busy, the payment is expected and the message refers to work everybody recognises. The financial risk sits in a small change within an otherwise ordinary task.

This illustrative situation belongs in a care insurance programme because dependable care also relies on dependable purchasing and cash management. Agency invoices, maintenance work, food supplies and equipment payments can reach colleagues working under operational pressure. A useful control must survive that pressure in the real payment process.

Acrisure’s published explainer distinguishes cyber insurance from crime insurance and discusses social-engineering fraud. [1] That distinction belongs alongside the payment controls: leaders need to understand the instruction, the verification and the possible insurance response before a fraudulent transfer forces the questions together.

Focus on what the message asks somebody to do

The fraud may involve a changed account, an urgent payment apparently authorised by a senior colleague or a request that bypasses the usual process. NCSC describes tailored messages impersonating legitimate contacts as a form of business payment fraud, also called business email compromise. [2]

For the provider, examine the proposed action rather than relying on familiarity. Does it change a supplier record, create a beneficiary, release a payment or redirect a refund? Identify where the instruction enters the finance process and who has authority at that point. A plausible invoice and a genuine underlying supplier relationship can still leave the destination of the payment unresolved. The working process should make that distinction visible to the colleague handling the request.

Build an independent verification step into the process

Use a contact route already established through the organisation’s approved supplier process when verifying a material change. A reply within the same potentially compromised email chain does not create independent confirmation. Record who checked, which trusted route was used and what the authorised supplier contact confirmed.

Report Fraud’s payment-diversion guidance recommends confirming requests through a separate channel with an established contact. [3] The provider should decide how that principle works for its payment arrangements, including deputies and urgent situations. Keep the verification evidence alongside the supplier-record change. The purpose is a traceable decision by somebody able to challenge the instruction before funds move, with an escalation route when independent confirmation cannot be obtained.

Make authorisation examine the change that matters

A second approval is useful when the approver has the information needed to challenge the transaction. Ask what they can see: the original instruction, the verified supplier record, a new beneficiary and any exception to the normal process. An approval that only confirms the invoice amount may leave the changed destination unexamined.

Walk through a fictional agency or maintenance payment with the people who prepare and approve it. Identify where duties are separated and where one person could make a change and release funds without a meaningful check. Do the same during leave or out-of-hours cover. The organisation’s own controls should fit its size and resources, with advice where needed, while keeping authority and the reasons for exceptions explicit.

Make it safe to pause an apparently senior instruction

Fraudulent instructions often exploit an employee’s wish to be helpful, efficient or responsive to a senior person. A written procedure becomes more convincing when leaders support the colleague who uses it. Demonstrate that a request in a director’s name can be checked through the same approved route.

NCSC’s phishing guidance recommends a layered defence rather than relying entirely on people spotting suspicious messages. [4] Bring technology, payment design, staff briefing and management behaviour into the review. Staff should know what to do when uncertain and who can authorise an alternative route for a legitimate urgent need. A service cannot expect consistent challenge if ordinary practice rewards bypassing the control whenever the day becomes busy.

Ask the cyber and crime question using the actual scenario

Acrisure’s May 2025 article explains that theft and social engineering may raise crime-insurance questions, while system compromise and related losses may raise cyber-insurance questions. It also notes variation between policies. [1] Those distinctions deserve examination through the provider’s operative documents.

Describe the possible event to the broker: whose account or instruction was involved, who authorised the transfer and what type of loss occurred. Ask which provisions, definitions, limits, excesses and conditions may be relevant, including any treatment of social engineering or fraudulent payment instructions. A transaction made through a computer does not by itself settle the policy question. Obtain a written explanation of the arrangements and the circumstances in which the answer could change.

Know the immediate route if a payment may be fraudulent

NCSC advises contacting the bank directly using an official contact route and informing the organisation’s IT department or responsible person promptly when business payment fraud is suspected. [2] Those actions should be accessible to the colleague who discovers the problem, including when the usual finance manager is away.

Follow the provider’s incident arrangements, preserve the relevant records and use applicable reporting and insurance routes. Do not assume that contacting a supplier or reporting through one channel completes the other responsibilities. Ask the bank what action it can attempt and the relevant advisers what evidence is needed. A prompt response can matter, but the publication cannot promise recovery, reimbursement or a particular insurance outcome.

Follow the change across a provider group

A group may centralise purchasing while individual homes maintain the supplier relationship. Establish who can verify a change and who updates the payment system. The colleague approving a central payment needs access to the evidence from the location that knows the supplier, through the approved process.

The same issue can arise after an acquisition or a change of finance personnel. Familiar trading names may sit alongside new legal entities, records or authority limits. Reconcile those changes before relying on inherited contacts and payment instructions. A shared procedure is more useful when local knowledge and central control can meet at a clear, documented verification step.

Learn from the transaction without losing the detail

Retain a controlled chronology of the instruction, verification, supplier-record change, approval and payment. If a control was bypassed, record what the person understood at the time and what made the alternative route appear acceptable. Preserve original messages and technical evidence through the competent team rather than circulating sensitive material widely.

Use the review to improve the process staff actually follow. The answer may involve supplier onboarding, clearer approval information, an accessible reporting route or leadership behaviour around urgent requests. Take the learning into the insurance discussion and the wider cyber review where relevant. A good financial control gives colleagues the confidence and means to verify a request, and gives leaders a record explaining why the payment was authorised.

Put the review into practice

Give each question an owner.

Finance and procurement leads
Trace supplier changes and payment approvals through the actual process, including deputies and urgent work.
Directors and managers
Support independent verification of instructions made in their names and define the exception route.
IT or security support
Prepare the account-compromise and evidence-preservation response within its remit.
Broker and appropriate advisers
Explain relevant cyber and crime wording, notification and support arrangements using the selected scenario.

Your working record / 12

The supplier-change and payment-authority review

Walk through a fictional payment request using the actual approved process. Do not include bank details, account credentials or personal information in this general working record.

  1. Choose an illustrative supplier-change or senior-instruction scenario.
  2. Follow the process with the colleagues who prepare, amend and approve.
  3. Record the control demonstrated and any gap in authority or evidence.
  4. Agree corrections and rehearse the relevant response route.
Open the full review Download the CSV worksheet

Take into the next leadership meeting

Questions that deserve a clear answer.

  1. Who independently verified the destination when the instruction changed?
  2. Can the approver see the change and the evidence supporting it?
  3. Will staff be supported when they pause an apparently senior request?
  4. Which response and policy provisions would the actual scenario require us to examine?

Acrisure / Further reading and specialist support

Take the discussion further.

Explore the relevant expertise on Acrisure’s own site, then use the questions and working record from this feature to prepare an individual discussion.

Ready to discuss your organisation’s position?

Speak to Acrisure’s care team

Sources, method & responsibilities

Follow the evidence.

  • Written and reviewed by the Care Circle Network Editorial Desk on 7 November 2026 for the sponsored programme with Acrisure. Published resources and previously published expert views are attributed; no new interview, technical approval or individual recommendation by Acrisure is implied.
  • Care Circle’s scenarios, review sequence and working records are original practical analysis. They are illustrative and do not describe an identified provider, establish a coverage gap or determine a claim outcome.
  • Source publication dates and geographical limits remain separate from this feature’s publication date. Insurance response depends on the operative wording and circumstances. Professional assessment and advice belong with the appropriately qualified adviser.
  • Complete working records within your organisation. Keep resident, staff, confidential policy and security information in your approved systems; the programme does not collect completed worksheets.
02

Business payment fraud

National Cyber Security Centre · Standing guidance; reviewed 7 November 2026

Read within the source’s stated scope. Provider-specific decisions require the relevant professional.
03

Payment diversion fraud

Report Fraud · Undated prevention guidance; reviewed 7 November 2026

Police fraud-prevention guidance on independent verification and payment controls. Replaces a non-retrievable PDF during the 7 November programme audit; reporting routes retain their own geographical scope.

Acrisure’s partner profile uses supplied corporate material. Care Circle authors the reporting and practical analysis. Published expert views and partner resources retain their original attribution and dates. Read the programme method.

Send a documented correction or editorial question

Continue the November collection

Follow the next
connected decision.

Return to the programme