Fraudsters made off with at least £32m using scams to redirect company payments in the past year.
Mandate fraud, where a criminal convinces a supplier or customer to send a genuine payment into a spoof account, resulted in more than 1,500 businesses making reports to the police in the year to April.
This is now the third most-popular way to defraud a business, behind fraudulent bank cards and employee fraud, according to official data.
The Metropolitan police dealt with the lion’s share of mandate fraud in the UK in the past year, with 256 reports of losses totalling almost £4.4m. West Midlands police handled 48 cases worth almost £8.3m in verifiable losses - making the region the most lucrative place for this fraud.
As well as persuading individuals to change direct debits for household bills, criminals also target companies to alter payment details for suppliers and intercept the money.
A spike in this type of crime targeted at charitable bodies prompted the Charity Commission to issue a fraud alert last year.
The scam will often only come to light when the genuine supplier chases their payment, said accountancy firm RSM, which obtained the data from Action Fraud.
“While in some cases the losses are relatively small, in others they can run into hundreds of thousands of pounds, potentially putting the future viability of the business at risk,” said Akhlaq Ahmed, forensic partner at RSM.
He added that training for staff, including exercises that test employees against phishing attempts, should minimise the risk of such an attack succeeding.