When a vendor's bank details suddenly change

How it works

Criminals get into a vendor’s mailbox, or yours, usually through a fake sign-in page. They read past emails to learn who pays whom, how invoices look and when payments are due.

Then they send a message at just the right moment. It may come from the vendor’s real account, or from an address that differs by one letter. The invoice is genuine; only the bank details are new. Often there is a reason to hurry: a late fee, an audit, a bank closing the old account.

By the time the real vendor asks where their payment is, the money has usually moved on.

The one rule that stops it

Never change payment details based on an email alone. Call the vendor on a phone number you already have on file, not one in the message, and confirm the change with someone you know.

Make it a process

• Write down the rule and make sure everyone who pays bills knows it, including the owner.
• Require a second person to approve any change to bank details.
• Be suspicious of urgency and secrecy, especially around month-end or holidays.
• If you think you have paid a fraudulent invoice, call your bank immediately. See what to do if you paid a fake invoice.