How the scam works
Criminals either break into a real email account (yours or a supplier's) or create a lookalike address. They watch real conversations, wait for an invoice to be due, then send a perfectly timed message: "Please note our bank details have changed — use the attached for this payment."
Because the email is in the right thread, at the right time, for the right amount, it looks completely genuine.
Warning signs
- Any change to bank details, however routine it sounds
- Pressure to pay quickly, or "before the old account closes"
- A sender address that's one character different from usual
- An overseas or personal-sounding account name
- The request arrives when the usual contact is "away"
- Replies that come from a slightly different address than the one you wrote to
The process that stops it
- Never change bank details on the strength of an email alone.
- Call to verify using a phone number from your own records, not the email or the new invoice.
- Use Confirmation of Payee and take the warnings seriously when the name doesn't match.
- Two people approve any new payee or changed details.
- Send a small test payment for large first-time payments, and confirm receipt by phone.
- Write it down. A one-page payments policy everyone follows, including directors.
Technical protections
- MFA on every mailbox, so attackers can't simply log in with a stolen password
- Alerts for suspicious inbox rules (attackers often hide replies in a rule)
- DMARC on your domain, so criminals can't easily send email as you
- External sender tags in Outlook
We set these up as part of cyber security.
If it's happened to you
- Call your bank immediately. Speed improves the chance of recovery.
- Report to Report Fraud (reportfraud.police.uk, 0300 123 2040).
- Assume the mailbox is compromised: reset the password, sign out all sessions, check inbox rules and forwarding.
- Warn the supplier or customer involved.
- Speak to your insurer if you have cyber or crime cover.
