Supplier Bank Details Changed? Make One Call Before You Pay
A familiar invoice with new bank details is the warning sign to stop on. Here is a simple check any business can use before paying a changed account, and what to do if money has already gone.
An invoice arrives from a supplier you have paid many times. The logo is right, the amount is right, and the tone sounds like them. The only difference is the bank account. That one change is how many payment scams work, and it is the moment to stop.
How the scam reaches you
Banks call this payment redirection, false billing or business email compromise (when a criminal uses a real or faked business mailbox to ask for money). CommBank's fraud team describes two common routes:
- A real mailbox that has been broken into. The criminal reads invoices for weeks or months, learns how you work, then sends a normal-looking email with new bank details at the right moment.
- A look-alike address. The email comes from an address one or two letters off the real one, so it passes a quick glance.
Because the criminal may have watched real conversations, the message does not always feel rushed or odd. CommBank says the old clues, like a strange font or a mismatched address, are becoming less reliable.
The one rule that works
Treat every new or changed bank detail as unconfirmed until someone checks it by phone.
- Call a number you already have. Use the number from your records, a past invoice or the supplier's known website, never the number in the email or on the new invoice.
- Confirm the exact details. Ask the supplier to read the new account details back to you.
- Hold payments to that supplier until the change is confirmed.
- Use two people. One person updates bank details; a different person approves the next payment.
- Turn on two-step sign-in (a code or app check on top of the password) for email and banking, especially for whoever pays the bills.
A real supplier will always wait for a two-minute phone call.
Check the address, not just the name
The name shown in an email can say anything. Look at the full address, and compare it with earlier emails from that supplier. Extra letters, swapped characters or a different ending such as .co instead of .com are common tricks.
The same tricks can be used against your own customers. Someone can register a domain that looks like yours and send invoices in your name. CertPing's free look-alike domain checker shows which of the 36 most common imitations of your domain are already registered. A registered look-alike is not always malicious, so look at it before you act. CertPing detects look-alikes and alerts you; it does not block them or take them down.
You can also make it harder for anyone to send email that pretends to come from your domain. The free DMARC and SPF checker reads your public email records and shows whether a receiving mail server would refuse forged mail. Mail servers, not CertPing, do the refusing.
If money has already gone
- Call your bank straight away and ask them to try to recall the payment. Speed matters, and recovery is not guaranteed.
- Keep the emails and the invoice. They show how the criminal got in.
- Change the mailbox password and sign out of all sessions.
- Report it. In the US, file a report with the FBI's Internet Crime Complaint Center. Elsewhere, use your national fraud reporting service.
The short version
A changed bank account on a familiar invoice is the signal. Stop, call the supplier on a number you already have, and only then pay.
Sources: CommBank Newsroom, "Why payment redirection scams are getting harder to spot", 19 October 2026; BridgeNet, "How Hackers Use Microsoft 365 Email to Redirect Payments", 4 November 2026; CertPing look-alike domain checker and DMARC checker pages, checked 9 November 2026.