Confirm every change of payment details by voice, on a number you already held, before paying anything. That single rule stops the entire category, and nothing else reliably does.

How it happens

An email arrives from a supplier you deal with regularly, referencing a real invoice, saying their bank details have changed and asking for the outstanding amount to be paid to a new account.

It uses the right names, the right amounts, and frequently continues an existing conversation, because the sender has been reading one of the two mailboxes involved for weeks.

The payment goes out, and the money is moved onward within hours.

Recovery is occasionally possible if the bank is told within a very short window and is frequently not, which is why this is the most financially damaging thing that happens to small businesses online.

Why it works on careful people

Worth understanding, because the instinct is that only careless businesses fall for this.

The message is expected. You were going to pay that invoice anyway, for that amount, to that supplier.

It arrives in an existing thread, so the history above it is genuine.

It is plausible: businesses do change banks, and a supplier saying so is not remarkable.

And it usually carries a small amount of pressure, often the suggestion that a previous payment failed or that an account is overdue.

None of the usual signals are present. There is no spelling error, no odd address to notice, and no obvious lie.

The one rule that works

Any change to payment details is confirmed by voice, on a number you already held, before anything is paid.

Already held is the entire point. Not the number in the email, not the number in the signature, and not the number on the attached document, all of which the sender controls.

The number from your own records, from a previous invoice, or from their website that you navigated to yourself.

Speak to somebody, say what you have received, and ask whether it is theirs.

That call takes two minutes and it defeats the entire method, regardless of how convincing the message is or how the sender obtained the information.

What to check on the message itself

These are useful and they are secondary. A sufficiently good version of this passes all six, which is why the rule above does not depend on spotting anything.

A worked example

A firm received an email from a supplier of eight years, in an existing thread, attaching a correctly formatted invoice and noting new bank details following a change of bank.

The bookkeeper thought it looked fine and phoned to confirm, because that was the rule.

The supplier had not sent it, and had been receiving similar reports from three other customers that week.

Their own mailbox had been compromised some weeks earlier, which was how the thread and the invoice format were known.

One of the other customers had paid.

The firm's owner noted afterwards that the bookkeeper had nearly not made the call, because everything about the message was right and phoning felt like implying the supplier could not be trusted.

That hesitation is exactly what the method relies on.

Make the call socially easy

The part that determines whether the rule survives contact with reality.

People do not skip the call because they forgot. They skip it because it feels like an accusation, or because the person who would have to make it is junior to whoever appears to have sent the message.

So the rule has to be stated as applying to everybody, without exception, and framed as something you do to protect the supplier as much as yourself.

Say explicitly that nobody will be criticised for making the call, and that anybody who pays a changed account without calling has broken a rule rather than made a judgement.

Tell your own suppliers you do this, which makes the call expected rather than awkward and frequently prompts them to adopt it.

The other direction

Your customers receive the same messages, apparently from you, and that is your problem as well.

Put a line on every invoice stating that your bank details do not change, and that any notification of a change should be treated as fraudulent and confirmed by phone on a number they already hold.

Say the same in the email that sends invoices.

If your details genuinely do change, phone your customers rather than emailing, and expect to be asked to prove it.

A customer who pays a fraudster believing it was you has still lost the money, and the relationship rarely recovers regardless of where the fault lay.

If it has already happened

Speed is the only thing that helps, and the window is short.

Telephone your bank immediately and use the words fraudulent payment, asking them to attempt recall. Hours matter and sometimes minutes do.

Report it to the police and to the national anti-fraud reporting service, which produces a reference your bank and insurer will want.

Tell the real supplier, since their systems may be compromised and other customers are probably being targeted.

Check your own mailboxes for forwarding rules and unfamiliar sessions, because the compromise may be at your end.

And notify your insurer promptly, since cover for this often carries strict reporting conditions.

The counter-case

There is a version of this that becomes an obstacle.

Phoning to verify every routine invoice from every supplier is not proportionate and will be abandoned within a month.

The rule is specifically about changes: new payment details, a new supplier's first payment, or an unusual amount. Ordinary invoices to accounts you have paid before do not need a call.

Some businesses also add a second approver for payments above a threshold, which helps and is not a substitute, since two people can be shown the same convincing email.

Narrow the rule to changes, apply it absolutely, and it will hold.

The rule

  1. Confirm every payment detail change by voice.
  2. Use a number you already held, never one from the message.
  3. Apply it to everybody, including the owner.
  4. Say nobody will be criticised for calling.
  5. Tell suppliers that you do this.
  6. Print the warning on your own invoices.
  7. Phone the bank within minutes if it happens.

Step two is the whole rule, since a number supplied by the sender confirms nothing.

Forged sender addresses are covered in the message that looks like it came from you.

Frequently asked questions

How does payment redirection fraud work?

An email from a supplier you deal with regularly, referencing a real invoice in an existing thread, says the bank details have changed. The sender has usually been reading one of the two mailboxes for weeks.

Why does it work on careful people?

The payment was expected, for that amount, to that supplier. There is no spelling error, no odd address, and no obvious lie. The usual warning signs are absent.

What actually stops it?

Confirming every change of payment details by voice on a number you already held. Not the number in the email or its signature, both of which the sender controls.

Why do people skip the call?

Because it feels like implying the supplier cannot be trusted, or because the message appears to come from somebody senior. Say plainly that nobody will be criticised for calling.

What if it has already happened?

Phone your bank immediately using the words fraudulent payment and ask for a recall. Hours matter. Then report it, tell the real supplier, and notify your insurer promptly.

Should I verify every invoice?

No. That is not proportionate and will be abandoned. The rule applies to changes: new payment details, a new supplier's first payment, or an unusual amount.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Received a change of bank details?

Phone them on a number from your own records before paying anything. Two minutes, and it defeats the entire method.

Start a Conversation