Small Town Sysadmin
Free CJIS checklist

Tech basics

Fake invoices and 'new bank details' emails: how to stop payment-change fraud

A plain-English routine for small offices to stop scammers who ask you to pay a fake invoice or send money to a new bank account, plus what to do in the first hour if a payment goes out.

One of the costliest scams aimed at offices doesn’t involve any hacking of your computers. Someone sends an email that looks like it’s from a vendor, a contractor, or your boss and says: “We’ve changed banks, please send the next payment here,” or “Please pay this invoice today.” If someone pays, the money goes to a criminal. The FBI calls this business email compromise, and its Internet Crime Complaint Center (IC3) reported more than 305,000 incidents and about $55.5 billion in exposed losses worldwide between October 2013 and December 2023. That figure comes from the FBI’s September 2024 alert, the latest full count in the sources checked for this article.

The scam works because it looks routine. The fix is also routine: one rule that never changes.

The one rule

Any request to pay a new account, or to change where money goes, gets confirmed by a phone call to a number you already had on file before the request arrived.

Not the number in the email. Not a number on the new invoice. Not a reply to the same email thread, because the scammer may be reading that mailbox. The FBI’s advice is the same in other words: verify account changes through a second channel.

Warning signs

  • A vendor’s bank details change, especially by email or “just this once.”
  • Pressure to pay today, keep it quiet, or skip the usual approval.
  • A sender address that is almost right, such as one letter off from the real company name, or a display name that matches but a different address behind it.
  • A request to log in through a link to “view the invoice.”
  • A message that appears to be from your boss or owner asking you to handle a payment personally and not call them.

The address check matters. The FBI advises confirming that sender addresses and web links match the real business, and watching for misspelled domains.

A simple routine for the office

  1. Keep a vendor list with the name, the phone number you trust, and who is allowed to approve changes. Build it from contracts or old paperwork, not from recent emails.
  2. Call to confirm every bank-detail change using the list. Write down who you spoke to and when.
  3. Require a second person to approve any new payee or changed account before the first payment.
  4. Ask your bank what checks it offers on new payees before the first large payment.
  5. Never send passwords, bank logins, or employee personal details by email, even when the request seems to come from a manager. The FTC gives the same advice to small businesses.
  6. Turn on two-step sign-in for email so a criminal can’t quietly read your mail. See Two-step sign-in.

If a payment already went out

Speed matters more than anything else. The FBI says time is of the essence.

  1. Call your bank right away and ask for a recall of the payment. Bank procedures vary, so ask what paperwork they need.
  2. File a complaint at ic3.gov as soon as possible, whatever the amount. The FBI says IC3 may be able to help banks and law enforcement freeze funds.
  3. Tell whoever handles your IT so they can check whether a mailbox was taken over, and change the email password from a device you trust.
  4. Notify the real vendor by phone so they can warn their other customers and check their own email.

If your own business’s email was faked to scam your customers, the FTC recommends reporting it to local law enforcement, IC3, and the FTC, and warning your customers quickly. When you email that warning, leave out links so it doesn’t resemble a phishing message. Ask your IT provider about SPF, DKIM, and DMARC, which are email settings that let other mail servers verify messages really came from you. The FTC recommends using providers that support these.

Banks and insurers set their own rules about recalls and covered losses. Ask your bank and your insurance agent what applies to you before an incident, not after. See also cyber insurance questionnaires.

For more on spotting the emails themselves, read How to tell if an email is a scam.

Sources

All articles