Sender Registry
Your supplier says their bank details have changed. Is it a scam?
One of the most expensive frauds a business can fall for starts with a completely ordinary email: a supplier you already work with, writing to say their bank account has changed, with a new sort code and account number to pay. Sometimes it is genuine. Often it is not. Here is how to tell the difference before the money leaves your account.
What the email looks like
It usually arrives mid-conversation, on a real invoice you were expecting, from an address that looks right. It is polite, unremarkable, and asks for one small thing: pay the new account from now on.
Hi, just a quick note that our bank account has changed as of this month. Please use the new details below for invoice 4471 and any future payments. Apologies for the short notice, we would be grateful if you could update your records today. Thanks.
Why this one works
This is called invoice fraud, or payment diversion. A criminal either breaks into your supplier's email account and waits for a real invoice, or registers a lookalike domain and imitates them. Either way, the request lands inside a genuine thread, about a genuine payment, at the exact moment you were already expecting to pay. Nothing about it feels like a scam, because almost nothing about it is fake. Only the account number.
The red flags to check
- A change you did not expect. A bank detail change out of the blue, especially with any pressure to use it quickly, is the single biggest warning sign.
- An address that is subtly wrong. A letter swapped, a .co instead of .com, or an extra word added to the domain. Read it character by character, not at a glance.
- A reply-to that differs from the sender. The name on the message and the address a reply would actually go to are not the same.
- A new account that does not fit. A different account name, or a different country, from the supplier you know.
- A nudge to keep it to email. Any hint that you should not phone to confirm is a reason to phone immediately.
How to check before you pay
There is one check that beats all of the above, and it takes two minutes. Call the supplier on a phone number you already have, from a previous invoice or your own records, never the number printed in the email. Speak to a person you know and confirm the new account out loud. A real supplier will thank you for it. A criminal cannot pass it.
Want a second opinion first? Forward it, free.
Send the email to Sender Registry and we assess the sender, the domain, and what the wider network already knows about it. No account, no card. You get a plain-English verdict back.
Common questions
How do I know if a supplier bank detail change is genuine?
Do not rely on the email. Call the supplier on a phone number you already hold, from a past invoice or your own records, never the number in the email, and confirm the new account with a person you know. A genuine supplier will be glad you checked.
What is invoice fraud or payment diversion?
It is when a criminal imitates or takes over one of your suppliers and emails you to redirect a real payment to an account they control. The invoice is often genuine. Only the bank details have been swapped, which is what makes it so easy to miss.
The email is from the correct address for my supplier. Could it still be a scam?
Yes. If a criminal has broken into your supplier email account, the message really does come from their address. That is why a phone check matters even when the address looks right.
We have already paid the wrong account. What should we do?
Contact your bank straight away, because a fast report sometimes allows the payment to be stopped or recalled. Tell your real supplier, and in the UK report it to Action Fraud. Then change any passwords that may have been exposed.
More on recognising a suspicious email: how to spot a phishing email →