Supplier bank-change fraud: red flags before you wire

If a supplier emails you new bank details, stop and verify before you pay. A request to change where payment goes is a classic sign of business email compromise (BEC), where a criminal poses as a vendor or colleague. Wires are hard to pull back once sent, so the check has to happen before the money moves.

This is a checklist, not a guarantee. It reduces your risk and doesn't remove it. It is general guidance, not legal advice. If you think you've been defrauded, contact your bank right away and report it to the FBI's Internet Crime Complaint Center (IC3).

How the scams usually work

Changed bank details. You get an email that looks like it's from a supplier you pay regularly, saying their bank account has changed. The IC3 describes fraudulent requests for "a change from one bank account to a different bank account under their control," and for a change in payment type, frequently from check to wire (IC3 PSA).

Spoofed or lookalike emails. The sender address or links look right at a glance but contain small misspellings of the real domain. The IC3 advises watching for hyperlinks "that may contain misspellings of the actual domain name" and checking sender addresses carefully, especially on mobile (IC3 PSA).

Fake support or "bank" calls. Someone phones claiming to be from your supplier's accounts team or your own bank, quotes a real invoice, and pushes you to act now. The details they know may come from a hacked inbox.

Compromised real accounts. Sometimes the email comes from the supplier's real address because their inbox has been taken over. A matching address is not proof.

Red flags before you wire

• New or changed bank details, especially close to a payment date.
• A different account country, bank or account holder name from the last payment.
• Urgency: "pay today or the shipment is held," or a last-minute change to wire instructions.
• A request to keep it quiet or not to call anyone.
• A switch in payment method, such as check or ACH to wire.
• Payment to a third party that isn't the company on the invoice.
• A request to send funds to a cryptocurrency exchange. The IC3 lists this as a warning sign.
• Slight changes in tone, wording or signature from the contact you know.
• Links asking you to log in to see an invoice or update details.

The checklist

1. Never change payment details from an email alone. Treat any change request as unverified until you confirm it another way.
2. Call back on a number you already had. Use the phone number from your contract, earlier invoices or the supplier's verified website. Don't use the number in the email asking for the change. The IC3 recommends verifying changes through a secondary channel.
3. Ask a second person to check. One person verifies, another approves.
4. Compare the new details to the old ones: bank, country, account name. Ask why they changed.
5. Check the sender and links. Read the full email address, and hover over links before you click.
6. Send a small test payment first when you add a new account, if your supplier agrees. This helps, but it is not proof the account is theirs.
7. Match the invoice to a purchase order you actually issued, for goods you expect.
8. Keep a record of who confirmed what, when and on which number.
9. Limit who can add or edit payees in your banking tools.
10. Keep your own email secure. Use multi-factor authentication, keep software updated and don't enter credentials from an email link.

If you've already sent the money

The IC3 advice is to contact your financial institution immediately and ask for a recall of funds, then file a complaint at ic3.gov as soon as possible, regardless of the amount. Speed matters, so call the bank first.

FAQ

Is a call to the number in the email enough? No. If the email is fake, the number may be too. Use a number you already had from a contract, an earlier invoice or an independently confirmed site.

What if the supplier is overseas and hard to reach? Try a second channel you trust: a known contact at the company, your sales rep, a trade partner or your freight forwarder. If you can't verify, hold the payment.

Can I get my money back after a wire to a fraudulent account? Sometimes, if you act quickly, but there is no guarantee. Contact your bank immediately and report to IC3.

Next step

No tool replaces the call-back step. When you are ready to pay suppliers, see Shield business accounts.