Supplier payment scams and last-minute bank-detail changes

1. What supplier payment diversion looks like

Invoice or mandate fraud happens when someone impersonates a supplier or another trusted organisation and persuades you to send money to a new or amended account. The message may arrive by email, phone, text or a messaging app. It may follow a real quote or invoice.

The UK Finance Take Five guidance for businesses describes criminals posing as trusted service providers and giving new or amended bank details. The guidance recommends confirming bank details directly with the company, questioning changes and contacting your bank immediately if you think you have been scammed.

The message can look convincing because the sender knows the product, order number, delivery date or names of people in the business. Familiarity is not confirmation. A genuine email thread can be compromised, copied or imitated.

The practical risk is simple: you believe you are paying a real supplier, but the beneficiary is controlled by someone else.

2. The two-minute stop procedure

Use this whenever a supplier sends new bank details, asks for an urgent payment or changes the beneficiary on an invoice.

1. Stop the transfer

Do not click the payment link, edit the saved supplier record or reply with a confirmation that the change is accepted. Tell the person responsible for payment that the instruction is on hold.

2. Preserve the evidence

Save the email, attachment, invoice, message headers where available and the previous bank details. Note when the change arrived, who sent it and what reason was given.

3. Use an independent contact route

Find a phone number or email address from the supplier's website, an earlier verified record, a signed contract or another trusted source. Do not use the contact details in the suspicious change message.

4. Ask a specific confirmation question

Confirm the legal beneficiary name, bank country, account ending, invoice number, amount and reason for the change. Ask whether the person confirming the request is authorised to change payment details.

5. Record the decision

Mark the request confirmed, open, hold or stop. Do not let an unanswered question disappear into the inbox.

If the payment has already been sent, contact your bank immediately. Use the relevant fraud-reporting route for your country. In the UK, Take Five directs victims to report fraud through Report Fraud. Do not wait for the supplier to confirm that something went wrong.

3. Red flags matter more in combination

One unusual detail may have a legitimate explanation. Several together are a reason to stop.

The most concerning combination is a changed beneficiary, urgency and a request to skip the normal callback. I would stop even if the product, price and email signature look familiar.

4. First payment and changed payment are different risks

The first payment to a new supplier needs an identity and beneficiary check. A change to an existing supplier's bank details needs that check again because the old trust relationship may be used to make the new request feel routine.

For a first payment, record:

• the legal seller;
• the quotation and invoice reference;
• the beneficiary name and bank country;
• the person who approved the supplier; and
• the independent confirmation of the payment destination.

For a changed payment, also retain:

• the old beneficiary record;
• the exact message requesting the change;
• the reason given;
• the new beneficiary and account details;
• the person who confirmed the change independently; and
• the second approval before the supplier record is edited.

Do not overwrite the old bank details as if they never existed. The change history is part of the control.

5. Build a small-team bank-detail control

You do not need a large finance department to create a useful process. You need a named owner and a second pair of eyes for exceptions.

For a one-person business, the second check can be a deliberate pause and a call made from a separate source. For a small team, make the person who requested the change different from the person who approves it where possible.

The point is not bureaucracy. It is to make it difficult for one convincing message to change the account and release the payment without anyone asking a second question.

6. A response script you can use

You do not need to accuse the supplier of fraud. You can state the control clearly:

Thanks for the update. We do not change supplier bank details from an email request alone. The payment is on hold while we confirm the beneficiary through our established contact route. Please do not send replacement instructions until we have completed that check.

If the request is legitimate, a real supplier should understand why you are checking. If the sender becomes angry, insists on secrecy or increases the pressure, record that as another signal and keep the payment on hold.

7. If the request has already been paid

Act quickly and keep the response factual.

1. Contact your bank immediately and explain that you suspect payment diversion or impersonation.
2. Preserve the email, invoice, account details, call notes and payment reference.
3. Contact the genuine supplier through a known route to confirm what happened.
4. Report the incident through the relevant authority. UK readers can use Report Fraud. Readers elsewhere should use their national fraud-reporting route.
5. Check whether the same sender or beneficiary appears in other supplier records.
6. Review who could edit supplier bank details and who can approve payments.

Do not promise yourself that the bank will recover the transfer. Ask the bank what information it needs and follow its process. The immediate objective is to limit further loss and preserve evidence.

8. How to keep the old record useful

Supplier payment controls fail when the evidence is scattered. Keep one folder or record for each supplier with:

• the supplier's legal identity;
• approved bank details and the date they were verified;
• quotations and invoices;
• contacts and independent phone numbers;
• prior payment confirmations;
• changes and approvals; and
• the next review date.

When a supplier changes its address, legal entity, contact, product or bank account, re-open the relevant checks. A bank change is not the only event that can alter payment risk.

9. What to do next

Use the supplier identity, VAT and bank reconciliation guide to compare the legal seller and beneficiary field by field. Keep the verification checklist with the purchase record. Then return to the complete supplier-vetting process for product, capability and terms checks.

This is general operational guidance, not banking, legal, cyber-security or financial advice. Reporting routes and bank procedures vary by country. Use the current guidance from your bank and the relevant authority.

10. Frequently asked questions

Is a changed bank account automatically a scam?

No. Suppliers can change banks, group companies or payment providers. The change should still be treated as unconfirmed until you verify it through a trusted route and record who authorised it.

Can I confirm the change by replying to the same email?

That is not enough. A genuine email thread may have been compromised or imitated. Use an independently sourced phone number or another established route.

Should I send a small test payment?

A small test payment can be one control for a first supplier, but it is not a substitute for identity and independent confirmation. Use the process your bank supports and do not assume a test payment proves the beneficiary's wider authority.

What if the supplier says the change is urgent?

Urgency is a reason to slow down, not a reason to remove the check. Tell the supplier the payment is on hold until the beneficiary is confirmed through your normal process.

What should I do if I already paid the wrong account?

Contact your bank immediately, preserve the evidence and report the incident through the relevant authority. Contact the genuine supplier through a known route and review other payments that may be affected.