In this guide 10 sections
At a glance
The short version.
Watch for
- New bank details or a changed payee introduced only by email
- An executive request that bypasses ordinary approval or procurement controls
- Confidentiality, unusual urgency, threats or flattering appeals to senior trust
Already acted?
Contact the sending bank immediately and request its fraud or payment-recall process.
See every recovery stepWhat is changing now
The current pattern.
Business email compromise can use a lookalike address or a genuinely compromised mailbox. Official guidance highlights executive payment requests, changed supplier bank details, payroll diversion and real invoice threads taken over by an attacker. AI can improve the language or imitate a voice, but process controls—not perfect detection—provide the stronger defence.
How it works
How the scam unfolds.
An attacker studies public roles, suppliers, payment timing and internal language, or gains access to a real mailbox. They wait for a plausible transaction and then introduce a new account, urgent payment or confidential executive request.
Because the surrounding conversation may be genuine, staff can see correct order numbers, signatures and prior messages. The fraudulent element may be only one changed attachment, reply-to address or sentence directing payment to a different account.
The best control sits outside email: dual approval, a known supplier contact, a documented call-back procedure and a rule that bank-detail changes cannot be authorised by the same message that requests them. A workplace should make early reporting safe even when money has already moved.
Warning signs
Reasons to stop and verify.
- New bank details or a changed payee introduced only by email
- An executive request that bypasses ordinary approval or procurement controls
- Confidentiality, unusual urgency, threats or flattering appeals to senior trust
- A subtle change in sender, reply-to domain or email routing
- A supplier who is suddenly unavailable through the normal contact person
- Payroll, gift-card or invoice instructions sent outside the established workflow
Spot the signs
What it can look like.
Highlighted phrases are warning signs; the numbered notes explain each one.
Tom · Northfield Supplies <accounts@northfie1d-supplies.example1 (warning sign 1)>
RE: Invoice 2291 — updated bank details2 (warning sign 2)
Hi Priya,
Following our recent audit, our remittance details have changed3 (warning sign 3). Please use the new account in the attached letter for invoice 2291 and all future payments.
Our director needs this settled by 3 pm today4 (warning sign 4) to avoid delaying your next delivery. I’m travelling, so email is the best way to reach me.5 (warning sign 5)
Kind regards, Tom
- A one-character difference
The sender’s domain swaps the letter ‘l’ in ‘northfield’ for the number ‘1’. Look-alike domains are easy to miss in a busy inbox.
- A change to where money goes
Any change to payment details is a high-risk event, even inside a genuine email thread.
- A believable reason
Audits, mergers and new banks are common explanations. The reason does not matter; the change still has to be verified.
- Senior pressure and a deadline
Invoking a director and a same-day deadline pushes staff to skip normal checks.
- Blocking a phone check
Saying they can only be reached by email stops you calling the supplier on a known number.
Call the supplier on the number in your existing records — never one from the email — before you change any payment details.
Composite example: names, numbers and “.example” addresses are fictional.
Worked example
A realistic pattern, separated into evidence.
This composite example is educational. It does not describe a real person or reproduce a live malicious message.
A real supplier thread announces new bank details
- 01The opening
Accounts receives a reply inside an existing invoice conversation. It references the correct project and amount and says the supplier has changed banks after a merger.
- 02The escalation
A revised invoice contains new account details. The sender says the finance director needs settlement today and that the usual supplier contact is travelling. A follow-up call appears to come from the supplier’s number.
- 03The decision point
Thread history and caller ID may both be compromised or imitated. The material change is the destination account, and the request attempts to bypass the organisation’s normal verification process.
Independent verification
Test the request without using its evidence.
These checks deliberately move the decision away from the person, link, number or account that introduced the request.
- 01
Verify the material change
Treat a new account, payee, amount, timing or approver as a new transaction even when the surrounding email history is genuine.
- 02
Use the approved vendor record
Call a known supplier contact from the organisation’s existing records. Never use the contact details in the change request.
- 03
Require separation of duties
The person receiving or entering a changed payment instruction should not be the only person authorising it.
- 04
Check the mailbox and business process
Report suspicious messages to IT or security. Review sign-ins, forwarding rules and delegated access if an account may be compromised.
Prevention
Make the next attempt harder.
- 01
Write down a callback rule
Make it policy that changes to supplier or payroll bank details are confirmed by phone using contact details already on file — and record who made the check.
- 02
Require two people for payments
Separate the person who sets up or changes a payee from the person who approves the payment.
- 03
Protect the mailboxes
Use strong multi-factor authentication for email, alert on new forwarding rules and review unusual sign-ins. Compromised mailboxes make these scams far more convincing.
- 04
Tell suppliers how you work
Let suppliers and customers know that you never change bank details by email alone, and ask them to call you if they receive such a message.
If you already acted
Protect access and contact the real provider.
- Contact the sending bank immediately and request its fraud or payment-recall process.
- Alert the recipient bank, supplier and relevant law-enforcement reporting channel where appropriate.
- Preserve full email headers, mailbox logs, invoices, approval records and payment details.
- Secure affected mailboxes, remove malicious forwarding or delegation and reset compromised access.
- Review adjacent supplier, payroll and customer conversations for further changed instructions.
Common questions
Short answers to real doubts.
The email came from the supplier’s real address. Is it safe?
Not necessarily. If the supplier’s mailbox has been compromised, a fraudulent request can come from their genuine address and inside a real conversation. That is why every change to bank details needs confirmation by phone through a contact you already hold.
How quickly should we act if we paid a fraudulent account?
Immediately. Contact your bank’s fraud team as soon as you notice, ask them to try to recall or freeze the payment, and report it through your national fraud-reporting route. The chance of recovering funds generally falls as time passes.
Are small businesses really targets?
Yes. Attackers target organisations of every size, and smaller teams often have fewer approval steps. A simple written rule — no bank-detail changes without a callback to a known number — is one of the most effective controls available.
Sources
Official guidance used for this article.
Stop & Verify summarises these sources for general education. Reporting routes and legal protections vary by location.