A supplier emailed new bank details, and the next payment is due.

The decision: pay the old account, the new one, or neither yet

Hold the payment until you have confirmed the change with the supplier by a second route. The FBI’s guidance for exactly this request is to use secondary channels, or a second sign-off, to verify any change in account information. Holding it for a day costs you a late-payment conversation with a supplier. Paying the wrong account costs you the payment.

The one call

Call the supplier on a phone number you already had before this email arrived: from an earlier invoice, your vendor file, or a contract. The Federal Trade Commission’s advice on messages that claim a change is to contact the company using a phone number or website you know is real, not the information in the message. A number printed in the email or its signature came from the same place as the request.

1. Ask for the person you normally deal with, or accounts receivable.
2. Ask them to read back the bank name, the last four digits of the account number, and the date the change takes effect.
3. Ask who at their company requested the change, and when.
4. Write down the name of the person you spoke to, the number you called, and the time. Put it with the invoice.
5. If the supplier says they sent no such email, stop paying from that thread and keep the email as it is.

Three signs in the request itself

• A change of payment type. The FBI notes that people running this scheme often time a request to switch from check to wire transfer, or from one bank account to another account they control.
• A look-alike sender. Read the full address, letter by letter, including the part after the @. The FBI advises checking that the sender’s address matches the sender it claims to be, and watching for misspellings of the real domain name.
• An invoice you can’t match. The FTC tells staff to check all invoices closely. Match the invoice number, the order or job it covers, and the amount against your own records.

Who should make the call

Pick a different person from the one who received the email and a different person from the one who releases payment. The FBI’s 2016 guidance on invoice fraud suggests verifying changes in vendor payment location with a secondary sign-off by company personnel. In a small office, that can be two people: one who calls and one who pays.

Write the rule down once, so the next change is routine: no bank detail changes by email alone, and nobody who can pay can also approve a change.

If a payment has already gone to the new account

Time matters here. Call your bank and ask them to request a recall of the funds, then file a complaint at ic3.gov, whatever the amount. If the wire was recent, the FBI also suggests contacting your local FBI office. The page on money sent to a fraudster covers the next steps.

What a phone call can and can’t settle

A confirming call tells you the supplier made the request. It doesn’t tell you whether their mailbox, or yours, has been tampered with. If you confirm the change and still see messages you didn’t expect, the mailbox is the next thing to look at.

When we look at this with you, we check the mailbox for rules, forwarding, and sign-in history, and tell you what was set, what wasn’t, and when we looked.

The call is how you find out who sent the email, which the email can never tell you.

Related

• A Look-Alike Domain Is Sending Invoices in Your Name
• Money Sent to a Fraudster: What to Do Today
• A Forwarding Rule in Your Email You Didn’t Create
• How to Bring a Security Concern to the Owner

Sources

• FBI Internet Crime Complaint Center: Business Email Compromise (PSA 240911)
• FBI Internet Crime Complaint Center: BEC, The $50 Billion Scam (PSA 230609)
• FBI Internet Crime Complaint Center: Business Email Compromise (PSA 160614)
• Federal Trade Commission: How to recognize and avoid phishing scams
• Federal Trade Commission: Run a small business? Pay your bills, not scammers