The Crime Survey for England and Wales estimated there were 4.2m fraud incidents in the 12 months to September 2025 – the most common type of crime in the UK.

Business fraud can take multiple forms, ranging from invoice and authorised push payment fraud to identity theft and insider asset appropriation. And data from recent UK Finance Annual Fraud Reports suggest perpetrators are increasingly adaptive; closing off one vulnerability often prompts an increase in a different type of fraud.

Add to this the fast-growing threat of AI-enabled fraud and cybercrime means there’s no room for complacency, says Laura Hough, ICAEW’s Director, Trust & Ethics and trustee of anti-fraud charity, the Fraud Advisory Panel. “Risks that we’ve been talking about for a very long time are still happening but, because the technology fraudsters are using is much improved, they are far more sophisticated.”

There’s never been a greater need for policies, procedures and processes that mitigate risks and ensure compliance with laws and regulations, especially now that failure to prevent fraud is classed as corporate crime when it happens in large organisations without ‘reasonable procedures’ in place.

Impact of new technologies

AI and other high-tech methods used by criminals mean that phishing emails and other malicious communications are becoming more realistic and harder to identify. It has also made it easier to profile staff and carry out attacks through social engineering, while the next generation of agentic AI can help criminals orchestrate ever more complex attacks at frightening speed.

What’s more, the increased adoption of fintech and the projected growth in the cryptocurrency market in 2026 may also represent increased risk for business. The Celsius scandal, which saw the CEO of the crypto assets platform sentenced to 12 years for fraud, has highlighted the need for tighter regulations around digital assets.

“Any time a new technology or way of working is introduced, fraudsters are ready to capitalise on it. It feels like they’re always one step ahead,” warns Hough. “New areas that not everyone fully understands are always going to present new areas of risk. It comes back to our professional and ethical obligations and ensuring we have the right skills and competencies in place.”

Signs of fraud

According to a Business Fraud Alliance guide on managing fraud risks, written by Hough, accountants should act if they spot the following signs:

Businesses can face several different fraudulent activities, such as overcharging on invoices, misappropriation of assets, false expenses and fake suppliers.

Risk management strategies

What’s needed is rigorous application of the basics, emphasises Hough. “Yes, there are all these new technologies and new ways fraudsters are using them, but the fundamental strategies are still critical – segregation of duties, physically securing your assets, knowing who’s working with you, and carrying out vetting.”

The Business Fraud Alliance has produced a variety of resources and helpsheets that provide good starting points, particularly for smaller businesses that need to start building greater fraud resilience.

The guide on managing fraud risks outlines common types of fraud, and gives advice on identifying risk factors, developing comprehensive formal policies, raising staff awareness and managing risks throughout the supply chain.

Meanwhile, a helpsheet on internal controls to prevent fraud outlines the policies, procedures and processes needed to mitigate risks and ensure compliance with laws and regulations. These include controls to help prevent fraud occurring, detect it when it does happen, and identify and repair vulnerabilities that have led to breaches.

Internal controls to prevent fraud

Internal controls are grouped into three categories:

The human factor

It’s important that having risk management strategies and policies in place doesn’t lull staff into a false sense of security, adds Hough. Staff training and awareness need to stay high on the agenda.

“It’s worth remembering that it’s often the human that makes the error. We can be the weakest link. It’s the person who clicks on that suspicious link,” she says.

“I always say to people: you know what the normal flow of your job looks like, and how things should be done, so you’ll know better than anyone when something odd pops up. You need to be alert to that and be clear on who you should tell and what the reporting lines are.”