PayeeGuard

Invoice fraud · checked 16 October 2026

A vendor emailed new bank details. Is it a scam?

Treat every bank-detail change that arrives by email as unverified, even when it really is from your supplier's address. Criminals often send these from the supplier's own hacked mailbox, inside a real email thread. The only reliable check is a phone call to a number you already had.

Check a suspicious email free Set up call-backs and approvals

Warning signs in the email

  1. The domain is slightly different. acme-invoices.com, acme.co instead of acme.com, acrne.com (r+n looks like m), or an extra letter.
  2. Replies go somewhere else. The Reply-To address is different from the sender, often a free Gmail or Outlook account.
  3. The sender's domain is days or weeks old. Fraud domains are registered just before use.
  4. It discourages a phone call. "I'm in meetings all day", "our phones are down", "reply by email only".
  5. There's pressure. "Overdue", "final notice", "pay today to avoid a late fee".
  6. There's a cover story. An audit, a frozen account, a merger, a "new parent company".
  7. The new account is abroad, or in a different name from the supplier's company.
  8. It asks you to stop paying the old account or to pay outstanding invoices to the new one straight away.
  9. The email failed authentication. In the original message headers, look for dmarc=fail or spf=fail.

None of these signs means the email is genuine when it's absent. A hacked real mailbox passes every technical check.

What to do, step by step

  1. Don't reply to the email or call any number in it.
  2. Find a number you already had: an invoice from before this email, your accounting system, a contract, or the supplier's website that you type in yourself.
  3. Call and ask them to read you the new account details. Don't read them out yourself; a fraudster on a forwarded line will just agree.
  4. Ask a colleague to approve the change before the account is used.
  5. Write down who called, the number, who you spoke to, what they confirmed and who approved. Your insurer may ask for it.
  6. If they say they didn't send it, tell them their email is probably compromised, and report it (see what to do after a fake invoice).

Already paid?

Call your bank's fraud line now and ask them to recall the payment. The first 24 to 72 hours matter most. Then follow these steps.

Make it automatic

PayeeGuard turns these steps into a routine: it checks the email, sends the supplier a secure link instead of accepting numbers by email, shows the phone number from your records, makes a second person approve, and records everything.

Check the email now Set up call-backs and approvals