Fake Bank-Change Requests: The Email Scam That Steals Business Payments

For small businesses, farms, churches and city offices, this is the scam with the biggest price tag. A trusted vendor emails to say they’ve changed banks and asks you to send the next payment — often a large one — to a new account.

The payment goes through. The vendor never receives it. And because it was a bank transfer you authorized, getting it back is difficult and often impossible.

How it happens

• Look-alike email addresses. A single changed letter — “suppIy” instead of “supply” — is easy to miss.
• Hacked vendor accounts. Often the email really does come from your vendor’s account, because the scammer broke into it and has been quietly reading their emails, waiting for an invoice to come due.
• Replies inside a real conversation, so it looks completely normal.
• Your own account. If your email is hacked, scammers can send fake invoices to your customers.

Red flags

• Any request to change bank or payment details
• Urgency: “the old account is closed,” “please process today”
• A slightly different email address or reply-to address
• A new contact person you haven’t dealt with before

A policy that stops it

1. Verify every bank change by phone using a number you already have on file — never one in the email.
2. Require two people to approve changes to payment details and large transfers.
3. Be extra careful with first payments to a new account.
4. Act fast if something goes wrong: call your bank immediately and ask them to recall the transfer, then file a report at ic3.gov.

Technical protections

Two-factor authentication on email, alerts for suspicious sign-ins, email authentication for your domain (SPF, DKIM and DMARC) and warnings for outside senders make these attacks much harder. We set all of that up as part of our managed cybersecurity. Read more in our post on the boss gift card scam, its smaller cousin. Call us at 620-960-8711.