The Bank Details Changed. The Invoice Didn't. A Small Firm's Payment Pause
Supplier invoice fraud has a boring disguise. It arrives as a reply in an existing email thread, references a real purchase order, and uses the same logo, footer and payment terms as last month. The only difference is a new bank account. For a small UK firm, that difference can be the whole year's cash buffer.
The scam usually takes one of two forms. Either someone spoofs your supplier's domain, hoping you won't notice a swapped letter in the address, or they compromise the supplier's actual mailbox and reply from the real account. The second version is nastier because every security banner, signature and email chain looks correct. The attacker simply waits for an invoice conversation, then steps in with updated payment details.
Why the second invoice feels so ordinary
Most payment fraud advice tells people to look for bad grammar and urgent threats. Useful, but incomplete. Modern supplier fraud is often well-written, unhurried and specific. The attacker may know the supplier's accounts contact, your purchase order number and the exact amount due.
Watch for these quieter signals:
- A bank detail change buried in an otherwise normal invoice email.
- A reply-to address that differs from the sender address, even slightly.
- Payment terms that suddenly shift, such as a request to pay before month-end or before a Friday.
- A new account name that almost matches the supplier but not quite.
- An email that comes from a director's mobile or a personal address because they are "out of the office".
- A PDF invoice with different bank details from the supplier record you already hold.
None of those proves fraud on its own. Together, they are a reason to pause. The important word is pause, not panic.
The rule that stops most of it: call a number you already had
The single most effective control is also the least technical. Any request to change a supplier's bank details gets verified by phone, using a number from your existing supplier record, contract or accounts portal. Not the number on the invoice. Not the mobile in the email signature. Not a number supplied in the same thread that asked for the change.
Call the supplier's main switchboard and ask for accounts. Say plainly: "We've had a request to change your bank details. Can you confirm the last four digits of the account you want us to use?" If the person cannot confirm, stop. If they ask you to call another number, find it independently.
For payments above an agreed threshold, make it a two-person job. One person checks the request; another makes the call-back and records the time, name and number used. That is not bureaucracy. It is a thirty-second insurance policy.
Also use Confirmation of Payee when your bank offers it. If the account name does not match the supplier name you expect, treat that as a hard stop. Do not override it because someone on the phone sounds convincing. Convincing is the job.
Three checks your IT provider can run this week
Technology will not replace the call-back rule, but it reduces the number of dodgy emails that reach finance in the first place.
First, check your own domain's email defences. SPF, DKIM and DMARC should be in place, with DMARC moving towards a reject policy where your mail setup allows it. DMARC does not stop someone spoofing your supplier's domain, but it makes it harder for attackers to impersonate yours. It also gives you reports showing who is sending email as your business.
Second, audit the finance mailbox for hidden rules. Attackers who compromise a mailbox often create forwarding rules or move invoice emails into a folder nobody checks. Look for auto-forwarding to external addresses, strange inbox rules and new delegates. Turn on multi-factor authentication, review active sessions, and remove anything nobody recognises.
Third, make external email obvious. A simple external-sender banner is not glamorous, but it helps staff notice when a "supplier" is writing from a lookalike domain. Combine that with blocking obvious lookalike domains and training the finance team to check the full email address, not just the display name.
A one-page procedure finance can actually follow
Write this down, print it, and keep it near the payment run. Keep it short enough that people use it on a busy Tuesday.
- Treat every bank detail change as a new supplier, even if the email thread is years old.
- Do not pay on the day the change arrives. Freeze the payment and note why.
- Verify by phone using a number you already hold. Record who you spoke to, the number and the time.
- Require a second sign-off for bank changes above your agreed limit.
- Run Confirmation of Payee before releasing the first payment to the new account.
- Update the supplier record only after verification, and note the change in your finance system.
- If money has already gone, call your bank immediately, ask for a recall, report it to Action Fraud, and tell the supplier. Preserve the emails and do not delete anything.
That last point matters. Speed gives you a chance of recovery. Shame gives fraudsters a second day.
Keep good suppliers moving
A payment pause only works if it is predictable. Tell regular suppliers at onboarding that your firm verifies any bank change by phone. Put it in your purchase order terms. Re-verify key supplier details once a year, or when a contact leaves. Use a supplier portal where one exists, and keep a register of verified bank details separate from the invoices themselves.
None of this needs a security team. It needs a habit: the invoice can look identical, but the bank details get a phone call. In 2026, that call is cheaper than the alternative.
