Invoice and bank-detail-change fraud

Check this example →

How it works

1. A criminal gets into someone’s email account, or sets up a near-identical address, and watches real invoice conversations.
2. At the right moment they send an email that looks like part of the thread: “our bank details have changed”.
3. The finance team updates the payee. The next payment goes to the criminal’s account, and it moves on within hours.
4. The real supplier chases an unpaid invoice, and that’s when it’s discovered.

This is sometimes called business-email compromise. It hits households too: conveyancing and building work are common targets.

The tells

• A change of bank details, especially “with immediate effect” or “the old account is closed”.
• A sender address that differs by a letter or a hyphen, or a reply-to address that isn’t the sender’s.
• Pressure to pay this invoice quickly.
• Reluctance to talk by phone.

What to do

• Phone the supplier on a number you already had on file, not one from the email, and confirm the change before paying.
• Require a second person to approve any change to payee details.
• If you’ve already paid to the wrong account: call your bank immediately and ask them to recall the payment, and tell the real supplier.
• Check the email headers or ask your IT team whether the genuine account was compromised.

Where to report it