How the scam works
An email arrives from a supplier, contractor or solicitor you already pay. It looks routine: an invoice, or a note that “our bank details have changed”. The new account belongs to the fraudster. Your next payment goes to them, and by the time the real supplier chases the invoice, the money has usually been moved on.
The email often comes from a look-alike address (one letter different, or a different ending), or from the supplier’s real mailbox after it’s been hacked, replying inside a genuine thread. Irish SMEs lost almost €19 million to email scams like this over two years, more than €22,000 each time on average (FraudSMART, Banking & Payments Federation Ireland, March 2026).
What it looks like
The red flags
- Any change of bank details by email, however polite or routine it sounds.
- Replies go to a different address from the one it came from, or the sender’s domain is slightly different from usual.
- The account is in another country, or at a payment app rather than the supplier’s usual bank.
- Urgency and secrecy: “pay today”, “keep this confidential”, “don’t call, I’m in meetings”.
- An invoice PDF that looks slightly off: different fonts, edited figures, a new reference format.
The one rule that settles it
Never act on a change of bank details until you’ve phoned the supplier on a number you already have, not one from the email. Since October 2025 banks also show a Verification of Payee name check, which helps, but it only checks the name on the account. It can’t tell you whether the email asking you to switch was genuine.
If you’ve already paid
Phone your bank immediately and ask them to recall the payment: the first hours matter most. Report it to your local Garda station, keep the emails (don’t delete them), and tell the real supplier so they can secure their mailbox.
Check it before you pay
Forward any invoice or bank-detail email to check@scam-less.com. Within a minute you’ll know if it’s safe to pay, with the reasons in plain English. Free for founding firms until 31 December.
Get free checks for your firmChecking a text or email for yourself? Use the free personal scam checker.
Common questions
What is invoice redirection fraud?
A fraudster pretends to be a supplier, contractor or solicitor you already deal with and tells you their bank details have changed, so your next payment goes to an account they control. It's also called mandate fraud or business email compromise.
Doesn't Verification of Payee stop this?
Only partly. Verification of Payee checks that the name you type matches the account. Fraudsters get around it with accounts in plausible names, or by persuading you to accept a 'close match'. It can't tell you the email asking you to change accounts was fake.
The email came from the supplier's real address. Is it safe?
Not necessarily. Fraudsters often get into a supplier's real mailbox and reply inside a genuine email thread. Treat any change of bank details as unconfirmed until you've phoned the supplier on a number you already have.
We've already paid. What now?
Phone your bank straight away and ask them to recall the payment: the first hours matter most. Then report it to your local Garda station, and tell the real supplier so they can secure their email.