Business Fraud Reporting and Investigation Process

Fraud affecting businesses can take many forms, from internal embezzlement and procurement fraud to payment scams, cyber‑enabled attacks, corporate corruption and organised economic crime. Knowing how to recognise, report and pursue an investigation into business fraud is essential for business owners, directors, solicitors, students and members of the public. This article explains the reporting options, the investigative process, key agencies involved, and practical steps businesses can take when confronted with suspected fraudulent conduct in England and Wales.

What Is Business Fraud?

Business fraud refers to deliberate deception or dishonest conduct aimed at personal or corporate gain, or to cause loss to a business. Examples include:

• False accounting or payment fraud
• Procurement and supply chain fraud
• Corporate services fraud by insiders or third parties
• Cyber‑fraud and phishing attacks targeting business systems
• Identity or invoice scams directed at companies

Fraud can affect a company's finances, reputation and legal compliance, so timely reporting and investigation are crucial.

Where to Report Business Fraud

1. Report Fraud (formerly Action Fraud)

For most businesses in England and Wales, the central reporting point for fraud and cyber crime is Report Fraud, which replaced Action Fraud in December 2025. Report Fraud guides users through an online questionnaire or accepts reports by phone (0300 123 2040), allowing organisations to explain what happened and obtain a crime reference number. Your report is passed to the National Fraud Intelligence Bureau (NFIB), a police unit responsible for analysing fraud reports and sharing them with the appropriate law enforcement agency for investigation.

Businesses should use Report Fraud where:

• They have been the victim of fraud or cyber crime
• They wish to provide information about suspicious transactions
• They are experiencing a live cyber‑attack (call 0300 123 2040 immediately)

Key point: Report Fraud is a reporting hub; it does not itself investigate crimes but passes intelligence to police forces and other enforcement agencies.

2. Local Police Forces

If the fraudulent activity is ongoing, a suspect is present, or there is immediate risk of loss, businesses can also contact their local police via the non‑emergency number 101, or dial 999 in an emergency. The local force assesses the referral and decides whether to open a criminal investigation.

3. Serious Fraud Office (SFO)

For serious or complex corporate fraud, bribery or corruption, reports may be made directly to the Serious Fraud Office. The SFO handles major economic crime cases involving significant loss, cross‑border elements, organised conduct or systemic corporate wrongdoing. Reports can be submitted via an online form, often through a corporate's legal representatives when large‑scale misconduct is suspected.

The SFO's corporate guidance emphasises self‑reporting and cooperation as a way to facilitate investigations and may lead to a Deferred Prosecution Agreement (DPA) instead of prosecution where appropriate.

4. Regulators and Other Agencies

Certain types of fraud may also be reported to specialist bodies, including:

• HM Revenue & Customs (HMRC) for tax‑related deception
• Financial Conduct Authority (FCA) for regulated financial services fraud
• Information Commissioner's Office (ICO) for data breaches under GDPR
• Industry‑specific regulators depending on the sector and nature of the fraud

Reporting to the correct authority ensures the most effective investigative response.

The Reporting Process

Step 1: Secure Evidence and Take Internal Action

Before reporting, businesses should preserve evidence securely:

• Save electronic records, emails, communications and transaction logs
• Create a timeline of events and suspected fraud indicators
• Restrict systems access where necessary to prevent tampering
• Document actions taken in response to the suspected fraud

This internal documentation will support any referral and assist investigators in understanding the case.

Step 2: Submit a Detailed Report

Use the online reporting tool on the Report Fraud platform or contact the SFO where appropriate. Provide:

• A clear description of the suspected fraud
• Details of financial loss, if known
• Names of individuals or entities involved
• Supporting documents and dates of key events

A crime reference number will usually be issued for police reporting, allowing the business to track progress.

Step 3: Intelligence and Triage

Once submitted, reports are handled by the National Fraud Intelligence Bureau (NFIB), which:

• Analyses information from multiple sources
• Links related reports and patterns
• Assigns cases to appropriate law enforcement bodies depending on severity and resources

Cases may be triaged and referred to regional police forces, specialist economic crime units or the SFO for further action.

Step 4: Law Enforcement Investigation

If a police force or agency accepts the case:

• An investigation team may be formed, which can include fraud squads or economic crime units.
• Investigators gather evidence, interview witnesses, and may seek search warrants or restraint orders.
• Business owners may be interviewed and asked to provide witness statements or documentation.

Serious investigations, particularly those handled by the SFO, can take several months or years depending on complexity and evidence volumes.

Step 5: Outcome and Enforcement Action

Depending on investigative findings:

• Criminal charges may be brought by the Crown Prosecution Service (CPS).
• For corporate cases, the SFO may negotiate Deferred Prosecution Agreements (DPAs), which can involve fines, compliance conditions and compensation orders in lieu of prosecution if certain criteria are met.

Not all reports result in charges; law enforcement agencies focus resources on frauds with clear evidence, offender identification and public interest considerations.

Encouraging Voluntary Reporting by Corporates

New guidance from the SFO emphasises that companies should consider self‑reporting suspected fraud and cooperating fully with investigations. Prompt self‑reporting with transparent evidence and cooperation improves the likelihood of reaching a DPA rather than facing prosecution, provided exceptional circumstances do not apply. The SFO aims to contact self‑reporting corporates within 48 business hours and decide on launching a formal investigation within six months.

Self‑reporting should include:

• All known facts and evidence
• Identification of individuals involved
• Details of jurisdictions and locations of key materials
• Information about risks to evidence integrity

This approach reflects a shift in enforcement strategy to encourage compliance and early disclosure.

Practical Considerations and Risks

Confidentiality and Whistleblowing

Many businesses implement whistleblowing policies to encourage internal reporting of suspected fraud without fear of retaliation. Protecting whistleblowers enhances the likelihood that fraud is detected early.

Internal vs External Investigation

Not all suspected fraud needs immediate law enforcement referral. In some cases, businesses should conduct internal forensic investigations with specialists before reporting externally, particularly where the evidence is complex or involves sensitive commercial information.

Coordination with Regulators

Fraud that crosses into regulated sectors may require coordinated reporting to both law enforcement and regulatory bodies, especially where client data, financial services or consumer protections are implicated.

Civil Remedies and Compensation

Even where criminal investigations do not proceed or conclude in prosecution, companies can pursue civil claims for compensation against perpetrators. Civil claims may involve restitution of losses and can be concurrent with criminal proceedings.

Key Takeaways

The process for reporting and investigating business fraud in England and Wales relies on coordinated reporting channels, intelligence analysis and law enforcement activity. Businesses typically begin by submitting detailed reports through the Report Fraud service, which feeds intelligence to the National Fraud Intelligence Bureau for assessment and referral to appropriate police or specialist units. Serious or complex corporate fraud may be reported directly to the Serious Fraud Office, especially where self‑reporting and cooperation can lead to negotiated outcomes such as Deferred Prosecution Agreements. Preserving evidence, engaging with investigators and coordinating with regulators strengthens the overall process. Understanding how fraud reporting and investigations work can help businesses protect their assets, comply with legal obligations and contribute to effective enforcement against economic crime.