The invoice is one you were expecting. The amount looks right, the supplier’s name is familiar, and the message fits an ordinary payment run.
Then you notice a small update tucked into the instructions. Before treating it as routine paperwork, take a closer look.
Overview
The genuine invoice can survive while the money goes elsewhere
The supplier bank details changed scam redirects a payment you actually owe. The fraud concerns the destination, not necessarily the invoice or underlying work.
A criminal impersonates your supplier and asks you to replace its saved banking information. Following that instruction can send an authorized payment to the wrong account.
The FBI describes business email compromise as a serious financial-fraud problem. Familiar business correspondence can be used to manipulate payment instructions.
A familiar conversation isn’t independent confirmation
The message might come from a lookalike address or a compromised genuine mailbox. An existing conversation can therefore contain both legitimate correspondence and fraudulent instructions.
Scamwatch warns about altered supplier payments. Replying to the questionable message doesn’t establish that the real supplier answered you.
Watch for changes involving:
- A new account number for an existing invoice.
- A different beneficiary or account-holder name.
- An explanation involving a new bank or accounting system.
- Instructions to ignore your saved vendor record.
- Pressure to process the change without the usual approval.
Pause the change, not the verification
A supplier can genuinely change banks. The safe response is to verify the request through contact details established before it arrived.
The illustrated email uses a fictional business and invoice amount. It demonstrates the suspicious change without identifying an actual supplier or real receiving account.
Do not update the payee or send the transfer until the genuine supplier confirms the new details through an independent, trusted route.
Why This Scam Can Fool a Careful Accounts Team
Most invoice checks ask whether the payment is due. You compare the purchase order, amount, delivery, and approval, then move the invoice toward settlement.
Payment redirection exploits the part of that process that can seem least interesting: the bank details underneath otherwise convincing paperwork.
If the supplier really delivered the goods, that fact doesn’t authenticate a new bank account. The debt and the destination need separate checks.
The same applies to a contractor you know personally. Confidence in their work isn’t evidence that the person emailing new instructions is actually them.
A plausible explanation can smooth over the change. Businesses do switch banks, replace accounting systems, and reorganize billing responsibilities.
The danger isn’t that every explanation sounds absurd. It’s that an ordinary explanation can be accepted without checking who supplied it.
A rushed employee may also worry about interrupting a supplier relationship. Calling to verify can feel distrustful when the email sounds friendly and professional.
Frame the call as your standard process. Genuine suppliers benefit when customers prevent payment from being diverted away from them.
Make that process consistent for small invoices too. A quiet exception can become the precedent used to justify a much larger change later.
How the Supplier Bank Details Changed Scam Works
Step 1: An expected payment gives the request a believable setting
The scam needs you to believe money should be paid. A real invoice, upcoming installment, or established supplier relationship can provide that setting.
Some attacks use information from compromised correspondence. Others rely on impersonation and a plausible business story. Don’t assume one particular intrusion occurred without checking.
From your side, match the invoice with your own records first. An unexpected bill and a changed destination on an expected bill are different problems.
If the invoice itself is genuine, keep investigating the new instructions. Passing the purchase-order check doesn’t mean the recipient account passed a bank-details check.
Step 2: The sender borrows the supplier’s identity
An email display name can be chosen by its sender. Seeing your supplier’s trading name above the message isn’t the same as authenticating its origin.
Expand the address and inspect it carefully. A substituted letter, extra word, or unfamiliar Reply-To address can reveal a lookalike.
A correct address still doesn’t settle the issue when a real mailbox is compromised. This is why the process cannot depend entirely on spotting spelling mistakes.
Don’t confuse technical email authentication with business authorization. A message can be delivered from a real account while containing a change the supplier never approved.
Step 3: New banking instructions replace a trusted record
The key request is the update. The criminal wants the account in your payment system to stop pointing at the genuine supplier.
They may put the new details in the email, an attachment, or a revised invoice. A professional layout doesn’t establish ownership of the receiving account.
Compare the instructions with the existing vendor record. Note exactly which fields changed and whether the account-holder name makes sense for the supplier.
Don’t quietly replace the contact record at the same time. A new phone number supplied alongside the account can undermine your attempted verification.
Step 4: A reply inside the thread supplies false reassurance
You ask whether the change is correct. If the attacker controls the conversation, they can answer yes and keep the paperwork looking consistent.
That second email doesn’t provide a second independent source. It may simply repeat the original deception in a more reassuring voice.
Use a known number from your established records. Ask your existing supplier contact to state the authorized details rather than merely agreeing with a number you read.
If that person refers you to another employee, verify the handover through the supplier’s established channels. Don’t follow a new contact introduced only by the suspicious message.
Step 5: Pressure turns the unverified update into a transfer
A deadline can make the check feel inconvenient. You might be told delivery will pause, a discount will disappear, or the supplier urgently needs settlement.
Those pressures don’t establish the bank account’s legitimacy. A payment held for verification is preferable to sending it somewhere you cannot reliably identify.
Don’t send a small test payment as a substitute for checking. It confirms that money can reach an account, not that the genuine supplier owns it.
When a second approver is required, give them the change request and verification record. Approving the invoice amount alone doesn’t cover the destination change.
Step 6: The genuine supplier still expects its money
The deception may become clear when the supplier chases payment. Your bank record shows a transfer, but the supplier says nothing arrived.
Stop before paying the invoice again. Establish where the first transfer went and notify your bank that you suspect payment-redirection fraud.
A fake explanation about processing delays can waste recovery time. Let your bank investigate the transfer rather than waiting for reassurance from the questionable sender.
The Checks That Matter Before Updating a Payee
Use contact details that predate the request
Your verification route should come from a signed contract, previously confirmed vendor record, or another source you’ve already established as genuine.
A phone number copied from the new invoice is part of the same unverified package. Calling it may only reach the person who wants the payment.
If your own records are incomplete, resolve that gap before transferring money. An inconvenient administrative check isn’t a reason to accept the stranger’s preferred route.
Be particularly careful when the person normally handling that supplier is absent. Ask who is authorized to confirm changes rather than relying on the nearest available colleague.
A replacement employee may know the invoice is due without knowing the approved banking arrangement. Make the verification record accessible to the people covering that role.
Confirm the whole change, not just the invoice number
Ask about the bank, beneficiary, account identifier, reason for the change, and when the new arrangement takes effect.
Record which invoice or future payments it covers. A supplier might authorize one arrangement for a specific entity without replacing every account you have on file.
Keep the confirmation with the vendor update so another employee can understand what was checked. A note saying called supplier is too vague.
Treat bank name checks as a safeguard, not an approval
Where your bank offers a recipient-name check, read the result before proceeding. A mismatch or unavailable check deserves attention.
A close match may have a legitimate explanation, but that explanation needs confirmation. Don’t override it simply because the email says the account is correct.
Even a matching name doesn’t validate the whole business request. You still need to establish that the supplier authorized the change.
Keep payment authority separate from changing records
For a business, consider requiring independent approval of vendor bank changes before those details can be used in a payment run.
The person approving the change should see the verification evidence, not just the new number. Otherwise the extra approval becomes another click instead of another check.
Discuss exceptions before a busy deadline arrives. A clear escalation route makes it easier for staff to pause without fearing they have broken the workflow.
What to Do if You Have Fallen Victim to This Scam
-
Call the sending bank immediately. Explain that a supplier payment may have been redirected by fraud and identify the exact transfer.
Ask about recall, tracing, and contact with the receiving institution. Recovery depends on circumstances; don’t wait for a promised refund from the sender.
-
Contact the genuine supplier independently. Confirm whether it authorized any change and whether it received the payment.
Preserve the legitimate invoice and original vendor details. Keep the disputed transfer separate from any genuine debt while you resolve the facts.
-
Hold further payments using the changed record. Notify the colleagues who can update payees or approve transfers.
Record which instructions are disputed. Don’t replace the account again using fresh details from the same compromised conversation.
-
Preserve the complete message trail. Save original emails, attachments, full headers where available, invoices, approval records, and transaction references.
A screenshot is useful for quick explanation, but retain the original message too. Your security team may need routing information a picture doesn’t show.
-
Have account access investigated when relevant. If your own mailbox or vendor account may be compromised, involve IT or the provider’s security support.
Check sessions, recovery details, forwarding rules, and unauthorized changes. A forged display name alone doesn’t prove your mailbox was accessed.
-
Report through the appropriate fraud channel. US businesses can file with IC3. In other countries, use the relevant police or national fraud-reporting service.
Include the payment amount, receiving details, timestamps, and bank case reference. Explain what you authorized and how the destination was misrepresented.
-
Review the failed control without blaming the person who reported it. Identify how the bank change reached approval and where independent confirmation was missing.
Make the correction specific, such as preserving trusted callback numbers or requiring a separate bank-change signoff, rather than sending another generic caution email.
Check whether the new details were copied into other systems, such as recurring-payment instructions or a separate purchasing platform. One correction may not update them all.
After a disputed change, identify those copies before the next payment run. Otherwise another employee could unknowingly use the same unverified destination.
Keep fraud-response contacts in the accounts team’s records too. Knowing whom to call at the bank saves time when a transfer needs urgent investigation.
When the Voice on the Phone Sounds Familiar
A callback is useful only when the route is trustworthy. A voice supplied through the suspicious message doesn’t turn that message into independent evidence.
Also avoid relying exclusively on a familiar-sounding voice or video. Australian government security guidance addresses impersonation risks around sensitive requests.
You don’t need to identify how a voice was produced to follow your established verification process. The process should work even when someone sounds convincing.
For repeated business relationships, agree on the approved change procedure in advance. Keep it somewhere staff can find when a last-minute request arrives.
Frequently Asked Questions
Can a genuine supplier email contain fraudulent bank details?
Yes, if the account or conversation is compromised. Verify changes through established independent contact details rather than relying on another reply in the same thread.
Does a real invoice mean the new account is safe?
No. The work and amount can be genuine while the payment destination is fraudulent. Check the bank change separately from the invoice approval.
Should I send a small amount to test the account?
No. Successful delivery only shows the account accepts money. It doesn’t establish that the supplier owns it or authorized the update.
What if the supplier really changed banks?
Complete your independent verification, document the authorized change, and then update the record through your normal process. Genuine changes still deserve those checks.
Can my bank always reverse a redirected payment?
No outcome is guaranteed. Contact the bank as soon as the problem is discovered and ask which recovery options apply to the actual transfer.
Will a malware scan recover the missing money?
No. Device investigation may be relevant to a separate compromise, but payment recovery requires the bank and fraud-response process.
The Bottom Line
Do not send money to changed supplier bank details until the real supplier confirms them independently. Familiar invoices and friendly replies aren’t a substitute.
If you already transferred the payment, call your bank now, stop further use of the changed record, and preserve the correspondence for investigation.
