Irish SMEs lost €18.9 million to email scams — most of it to invoice redirection.

Ireland's banks publish what most of Europe does not: a loss figure for the fraud that specifically targets businesses paying invoices. Through FraudSMART, the Banking & Payments Federation Ireland reported €18.9 million lost by SMEs to email-related scams over two years to March 2026 — and named invoice redirection as the majority of cases, with CEO and executive impersonation second.

The per-incident economics are what make this existential for a small company: the average loss for an SME that got hit was more than €22,000. And the exposure is close to universal — 67% of Irish SMEs were targeted by a financial scam in the previous 12 months, with 88.4% of attempts arriving by email. Over half of Irish SMEs, 53%, have no fraud-awareness guidelines or staff training at all.

The regulatory data tells the same story from the bank side. The Central Bank of Ireland's payment-fraud statistics put total fraudulent payments across all instruments at €160.2 million in 2024, up from €128.6 million in 2023 — with €67.7 million of it on credit transfers, the instrument used to pay suppliers.

Ireland is unusual in one respect worth knowing: it is one of only six EU/EEA countries where customers do not bear more than 80% of credit-transfer fraud losses — Irish banks absorb a comparatively larger share than banks elsewhere in Europe. That is a genuine difference, but it is not a reimbursement right, and it should not be mistaken for one.

The Irish data is unusually direct about the exact crime this page is about. Invoice redirection is not a sub-category of something broader here — it is named, counted, and identified as the majority of the €18.9 million Irish SMEs lost to email scams over two years, at more than €22,000 a time.

The exposure numbers explain why it works: two thirds of Irish SMEs were targeted in a year, nearly nine in ten of those attempts came by email, and more than half of Irish SMEs have no fraud training or guidelines in place at all. The attack arrives in the same inbox and the same format as every legitimate invoice.

PayHQ is the control that gap is asking for: every incoming invoice is checked against the supplier record your team has already verified — name, registration and bank details — and a changed account is held for review before the payment is released, rather than discovered afterwards.