A supplier says their bank details have changed: how to spot invoice fraud and what to do if you've already paid

What the scam looks like

Business email compromise (BEC) doesn't need malware in your accounting system. It needs one email at the right moment. It usually takes one of three forms:

• A change-of-details notice. The "supplier" writes to say they've switched banks and future payments should go to a new account. It arrives just as a real invoice is due.
• A doctored invoice. The invoice is genuine – right amount, right line items, right logo – except for the account number.
• An invoice or reminder for something nobody ordered. Czech police have described a fraudster posing as a software company and sending several businesses invoices with payment reminders, counting on busy accounts staff to pay rather than risk a late fee.

How big the problem is

In September 2024 the FBI's Internet Crime Complaint Center reported more than 305,000 incidents worldwide between October 2013 and December 2023, with over $55 billion in exposed losses. BEC was reported in all 50 US states and 186 countries, and fraudulent transfers went to more than 140 countries. It hits everyone from small local firms to large corporations – and individuals making personal payments.

Three cases from the Czech Republic

We're a Czech site, so here are cases police there have published recently. The pattern is the same everywhere.

• 2026, about €18,000. A fraudster got hold of an email from a travel agency containing an invoice for a trip, changed the account number and sent it on to the customer so that it looked like routine correspondence. The organisation paid CZK 452,000. It was the bank that flagged the payment as risky and phoned them – only then did the accountant discover the account had been swapped (Czech Police, May 2026).
• 2025, over CZK 1.3 million. A foreign partner sent an invoice, followed by a second email asking for payment to a different account. It happened several times over a few weeks – one invoice for almost €17,000, then another €18,000. Only when the partner's director chased three unpaid invoices did the company notice that the second email's address had two letters swapped (Czech Police, July 2025).
• 2021, no loss. A criminal took over one company's mailbox and sent its customers a "change of account". The customers phoned the company to check, and nobody paid. Police noted that in such cases the perpetrators are almost impossible to identify and the money is rarely recovered, especially when the fraud is reported late (Czech Police, November 2021).

Why businesses fall for it

• The sender looks familiar. Either it's the supplier's real mailbox in the attacker's hands, or an address that's one character off. The FBI specifically advises checking the full sender address, especially on a phone, where the difference is harder to see.
• It follows a real deal. An attacker reading the mailbox knows order numbers, amounts, deadlines and who in your company pays the bills.
• It's a long-standing partner. Police note that recipients usually trusted the change precisely because they'd worked with the supplier for years.
• It looks professional. Logos, signatures and invoice layouts are easy to copy.

A rule for the whole business: verify first, then pay

The best protection needs no technology at all. Agree a few rules and make sure everyone who pays invoices knows them:

1. Every change of bank details means a phone call. Call your contact at the supplier on a number from the contract, earlier correspondence or their official website – never one from the email or invoice announcing the change. This is the FBI's first recommendation.
2. Compare the account with past payments. An account that differs from the one you've paid for years is a reason to stop, especially before a large payment.
3. Check unexpected invoices and reminders first. Is there an order behind it? Do the supplier's details match? If in doubt, call the supplier on their published number.
4. Read the whole sender address. Look for swapped, doubled or lookalike characters ("rn" for "m", "0" for "o") and a different domain ending. Our guide How to spot a fake link explains how to read domains – email addresses use the same tricks. The FBI also suggests configuring staff computers to show full email addresses.
5. Urgency and exceptions are red flags. "Pay today or…", "don't discuss this with colleagues", "our old account is frozen for an audit" – even if the supplier is real, confirm that kind of exception by phone.

Protect your own mailbox too

If an attacker takes over your mailbox, they can send these emails to your customers – who will then pay them. The FBI recommends a unique password for every service and verifying account changes with a second channel or two-factor authentication. In practice:

• Turn on two-step verification for every business email account, starting with finance and management.
• Use a password manager so every service has a different password.
• If you suspect a compromise, check mailbox rules first. An attacker can set up forwarding, or a rule that moves the supplier's replies into a folder nobody reads, so the victim notices nothing. You'll find these under Rules in Outlook, and Filters and Forwarding in Gmail.
• Set up email authentication for your domain. The FTC advises choosing an email provider that supports email authentication, so receiving servers can block or quarantine messages that only pretend to come from your company.

Already paid?

1. Call your bank immediately. Say it's fraud and ask them to stop the payment or request a recall from the receiving bank. The FBI stresses that time is of the essence – criminals move the money on fast. Ask what help your bank can offer, as policies differ.
2. Report it. In the US, file a complaint at ic3.gov as soon as possible, whatever the amount – the FBI says IC3 may help banks and law enforcement freeze funds. Elsewhere, report to the police and your national fraud reporting service.
3. Call the real supplier on a verified number. They need to know someone is writing in their name, and that their mailbox may be compromised.
4. Preserve the evidence. Don't delete the fraudulent emails. Save them with full headers ("Show original" in Gmail, "View message details" in Outlook), along with the invoice and the payment record.
5. If the attack came from your mailbox, change the password, sign out all sessions, turn on two-step verification, check rules and forwarding, and warn your customers – by phone, or by email without links. Our guide Hacked account: what to do walks through the steps.

If someone is impersonating your business

The FTC recommends reporting it to local law enforcement, the FBI's IC3 and the FTC, and telling customers as soon as possible – by post, email or social media. If you email them, don't include links, so your warning doesn't look like phishing. Remind them that you'll never ask for bank or card details by email or text.

The same trick is used on individuals, too – for example a message "from your hotel" that knows your booking. See Hotel or Booking.com message asks to verify your card.