A woman spends three weeks talking to a man she met online. He sends photographs of his dog, complains about work and remembers when she has a doctor’s appointment.
Then he needs £2,000.
His bank account has supposedly been frozen. He’ll return the money on Friday.
The photographs weren’t his. The job didn’t exist. Friday comes, and he’s gone.
That sort of deception has become expensive. UK Finance’s 2026 Annual Fraud Report recorded £39.2 million in romance fraud losses during 2025, up 23% from the previous year. The number of reported cases also increased, reaching 6,335.
For someone running an online business, the interesting part isn’t only the stolen money. It’s how much effort went into making the victim comfortable enough to pay.
A convincing identity. Familiar messages. Small details that seemed to check out.
Fraudsters understand customer confidence rather well. Unfortunately, legitimate businesses have to deal with the suspicion they leave behind.
A customer searching for complaints hasn’t necessarily walked away
Imagine you’re selling a £600 refurbished laptop.
Your website looks professional. The product photographs are clear, delivery is advertised as free and the customer has reached the checkout.
Then they open another tab.
They search for your company name followed by “scam”.
A few years ago, an owner might have considered that a reputation crisis. Today, it’s fairly ordinary shopping behaviour.
People do the same thing before paying for dating services, booking accommodation or using an unfamiliar investment platform. Someone researching an online dating provider might search for dating com scam to look into potential complaints and other users’ experiences.
That doesn’t establish whether the company is trustworthy. It’s simply one way customers begin checking.
Try searching for your own business sometime.
Does the registered company name match the name on the checkout page? Can customers find a real contact address? Are refund terms visible before payment?
If a customer wants to cancel a subscription, how many screens must they visit?
I’ve seen perfectly ordinary checkout designs that would make a cautious buyer nervous: mismatched company names, unclear billing dates and support pages that offer nothing except a form.
None proves fraud. All are avoidable reasons to abandon a purchase.
The payment is usually the last move
Romance scams are particularly revealing because the payment often comes after a long period of ordinary conversation.
Nobody begins with “Please transfer £8,000.”
Instead, there’s a story. A relationship develops. The eventual request is presented as a temporary problem between people who already trust each other.
Other scams follow similar patterns.
A criminal impersonating a supplier might begin by referring to a genuine invoice number. Someone pretending to be a company director may use the correct job title and email signature.
By the time new bank details arrive, the message looks familiar.
UK Finance reported that criminals stole £1.28 billion through payment fraud in 2025. It also found that 66% of authorised push payment fraud cases began online.
For a small company, that makes its everyday communication channels relevant to security: email, customer accounts, invoices and even social media messages.
Suppose a supplier you’ve worked with for six years emails new bank details on Thursday morning.
The invoice is correct. The amount is expected.
What isn’t expected is the account number.
Call the supplier using the telephone number already in your records. Not the number in the new email.
That one step may be more useful than an expensive security badge on your website.
Four hundred and three payments should raise questions
In October 2025, the UK’s Financial Conduct Authority called for better controls against romance fraud.
The cases it reviewed included one victim who lost £428,000. Another made 403 payments totalling £72,000.
Four hundred and three.
For a bank, that raises difficult questions about detecting suspicious payment patterns. For an SME, the equivalent may be much smaller.
A customer who normally spends £40 suddenly places a £1,900 order from a new device and changes the delivery address.
A supplier asks for urgent payment to a newly opened account.
An employee requests a bank transfer outside the company’s usual approval process.
Those situations deserve a second look.
Not every unusual transaction is fraudulent. The point of checking is to distinguish legitimate changes from suspicious ones before money disappears.
Big companies can buy sophisticated monitoring systems. A small business might need something much less elaborate: a second person to approve change payment details, a clearly documented callback procedure and permission to pause an order.
That last part matters.
If employees believe they’ll be criticised for delaying a transaction, some will process it despite doubts.
Make it easy for staff to question something
An accounts assistant notices new bank details on an invoice from a supplier the company has used for years.
The email looks genuine. It refers to a real purchase order. The amount is correct.
But the account number has changed.
Should the assistant interrupt the finance director, who’s already late for a meeting?
Absolutely.
The Financial Conduct Authority’s 2025 review of romance fraud found cases where financial firms missed repeated warning signs. One victim made 403 payments over a year, losing more than £72,000.
Those weren’t 403 opportunities for a clever fraudster alone. They were also opportunities to spot activity that didn’t fit the customer’s usual behaviour.
Small businesses don’t need a bank’s monitoring department. They need a clear answer to three questions: Who can hold a suspicious payment? Who checks it? Who authorises its release?
A ten-person company can make those decisions quickly, provided somebody has responsibility for them.
