An email from a supplier says their bank account has changed. Maybe it’s a letter on headed paper, maybe a line at the bottom of a normal invoice. Suppliers do switch banks. But a change of bank details by email is also exactly how invoice redirection fraud starts, and once a payment goes to the wrong account it’s often gone within hours.
So treat every change as unconfirmed until you’ve checked it yourself. Here’s how.
Before you change anything
- Don’t reply to the email, and don’t use any number in it. If the email is fake, the phone number on it is the fraudster’s too.
- Ring the supplier on a number you already have: from an old invoice, your accounts system, their website, or the person you normally deal with.
- Ask a question only the real supplier can answer, such as the amount of the last invoice you paid, or a reference number on it.
- Read the new account details back to them and ask them to confirm, rather than asking them to read the details to you.
Warning signs in the email
- The sender’s address is slightly different from usual: a swapped letter, an extra word, or a different ending.
- Replies would go to a different address from the one it came from.
- The new account is in another country, or with a bank or payment app the supplier has never used.
- There’s pressure: an overdue invoice, a penalty, or a request to keep it quiet.
- The email arrived inside a real thread with the supplier. Fraudsters who get into a supplier’s mailbox often reply to genuine conversations, so a familiar thread is not proof.
Make it a rule, not a judgement call
The firms that don’t get caught aren’t better at spotting fakes. They have a simple rule that everyone follows: no change of bank details is made without a phone call to a known number, and a second person signs off large or first-time payments to a new account. Write it down, tell your suppliers you work this way, and nobody has to feel awkward about checking.
Doesn’t my bank’s name check cover this?
It helps. Banks in Ireland and across the euro area now run Verification of Payee, and UK banks run Confirmation of Payee: both check the name you enter against the account. But a fraudster can open an account in a name close to your supplier’s, and neither check can tell you whether the email asking you to switch was genuine. Use the bank’s check as well as the phone call, not instead of it.
If you’ve already paid the new account
- Ring your bank immediately and ask them to recall the payment. The first hours matter most.
- Report it to the police: in Ireland, your local Garda station; in England, Wales and Northern Ireland, Report Fraud (the service that replaced Action Fraud); in Scotland, Police Scotland on 101.
- Keep every email, including the headers, and don’t delete anything.
- Tell the real supplier, so they can secure their email and warn their other customers.
Get a second opinion before you pay
Forward any invoice or bank-detail email to check@scam-less.com. Within a minute you’ll know whether to pay it or hold it, with the reasons in plain English. Free for 30 days, no card.
Sources: City of London Police: Report Fraud service launch.
Common questions
Is a change of bank details by email always a scam?
No. Suppliers do change banks. But it's the most common way invoice fraud starts, so treat every change as unconfirmed until you've phoned the supplier on a number you already had.
What should I ask when I ring the supplier?
Ask them to confirm the new account details, reading them back from your side, and ask something only the real supplier would know, such as the amount of the last invoice you paid.
The email came from my supplier's real address. Is it safe?
Not necessarily. Fraudsters often get into a supplier's real mailbox and reply inside genuine threads. The phone call to a known number is what settles it.