The message looks ordinary. A supplier you have paid for years writes that their bank has changed, attaches a new invoice with a new account number and asks you to use it from now on. The logo is right, the tone is right, and the sender address looks almost right. If nobody checks, the next payment goes to a stranger.
This kind of fraud is usually called business email compromise or invoice redirection. Law enforcement agencies describe it as one of the costliest forms of online fraud, and it targets small companies as much as large ones, because small companies often have one person paying invoices and no second look. This article describes a minimal rule that fits a team of three to thirty people.
The rule in one sentence
A change of bank details is not accepted until someone has confirmed it by phone, using a number your company already had before the change request arrived.
Everything else is detail. The number matters most: a phone number in the signature of the same email, or on the new invoice, belongs to whoever wrote that email. Use the number from your supplier record, from the original contract, or from an earlier invoice that you have already paid. If you have none, find the company's published number independently and say in the log that you did.
What counts as a change
Treat all of these the same way:
- a new account number or IBAN on an invoice, even if the invoice is otherwise identical;
- an email or letter announcing "new banking details";
- a request to pay a different company name, a personal account or an account in another country;
- a change that arrives together with urgency: "please pay today, the old account is closed".
Urgency is not proof of anything. If anything, it is a reason to slow down. A genuine supplier understands a one-day check.
Who verifies
Split the work between two people, even if the company is small.
- The verifier makes the call and writes the log entry. This is usually whoever looks after supplier records, or the office manager.
- The releaser approves the payment, and only after seeing the log entry. This is usually the owner or the person who signs invoices, as in the invoice approval routine.
If there are only two of you, still keep the roles apart: the person who received the change request should not be the only one who confirms it. If one person must do everything, add a delay of one working day before the first payment to the new account.
How to make the call
Keep the call short and the same every time:
- Call the number you already held. Ask for the person who handles accounts or, if you cannot reach them, the person you normally deal with.
- Say that you received a request to change bank details and you want to confirm it. Do not read out the new account number first; ask them to read it to you.
- Compare the number they read with the one in the request, digit by digit.
- Ask one question only your real supplier can answer, such as the last order or the name of your usual contact.
- If the person on the phone cannot confirm the change, or says they know nothing about it, stop. Do not pay and do not reply to the original email. Pass it to your owner and, if money has been sent, to your bank straight away.
For a supplier you have never paid before, the same rule applies at onboarding. Collect the bank details once, verify them once and store them in the record, as in the supplier onboarding checklist.
What to log
The log can be a column in your supplier list or a short note attached to the record. Five lines are enough:
- Date and time of the verification.
- Who called (the verifier).
- Number used and where it came from (supplier record, contract, earlier invoice).
- Who answered and what they confirmed.
- Who released the payment and on which date.
Keep the original request too. If the message was fraudulent, it is evidence. If it was genuine, the log shows later that you did your job. Do not copy full account numbers into chat messages or long email threads; the record is the one place for them.
Small habits that help
- Change details only in one place. Only the verifier updates the supplier record, and only after the call. Staff who receive invoices never edit it.
- Compare against the last paid invoice. If the account on a new invoice differs from the last one, treat it as a change even when nobody announced it.
- Look at the sender, not just the name. Check the full address and the domain. A swapped letter, such as an "rn" in place of an "m", is a common trick. If you want a refresher on what to do with a suspicious message, read what to do in the first ten minutes after staff report a phishing email.
- Tell the team once a year. Ten minutes at a team meeting is enough: here is the rule, here is who verifies, here is what to do if you are unsure.
If you think you have already paid the wrong account
Act within hours, not days. Contact your bank at once and ask whether the payment can be recalled; the chance is highest right after the transfer. Then tell the real supplier, keep all messages, and report the fraud to the authorities in your country. Afterwards, add one line to your log and check what step was skipped, without looking for someone to blame. The aim is a rule that works on a busy Friday afternoon.
A short start
This week, write the rule on one page and name the verifier and the releaser. Next, check that your supplier list has a trusted phone number for every supplier you pay regularly; add the missing ones from contracts or earlier invoices. From then on, hold the first payment after any change until the log has five lines. The rule costs about ten minutes per change, and most months there will be none.