New bank details by email? Do this before you pay
Payment-diversion fraud is one of the costliest scams a business can face. Here is how it works and the one habit that stops it.
An email arrives from a supplier you work with every month. Same name, same signature, same tone. They have changed banks, and the next invoice should go to the new account.
Nothing about it looks wrong. That is exactly why it works.
How payment-diversion fraud works
Attackers do not need to hack your systems for this. They only need you to believe the email. Usually they:
- Register a lookalike domain, such as
supp1ier.cominstead ofsupplier.com, or - Break into the real supplier’s mailbox and send the request from a genuine address, often replying inside a real email thread.
Then they wait for a payment to be due and send the “updated details”. Once the money leaves, it is very hard to get back.
The one habit that stops it
Never change payment details based on an email alone.
Call the supplier on a phone number you already had, from a previous invoice, your accounting system or their website. Never use a number from the email asking for the change.
That single call defeats both versions of the attack, including the one sent from a real, compromised mailbox.
Other warning signs
- Urgency. “The payment must go today or the account will be frozen.”
- Secrecy. “Please don’t call, I’m in meetings all day.”
- A domain that is almost right. Read it letter by letter.
- Small changes in the thread, such as a new reply-to address or someone new copied in.
For IT teams
- Publish SPF, DKIM and DMARC for your own domains and move DMARC towards enforcement. It makes spoofing your domain much harder.
- Flag or warn on external emails that use lookalike domains of your regular contacts.
- Make the call-back check part of your finance process, so it does not depend on one person remembering.
If something feels off, it costs one phone call to check. Getting it wrong costs far more.