New Bank Details? Call First.
Invoice changes and new bank accounts must be verified through contacts established before the request.
Illustrative scenario
How It Looks in Real Life
A long-standing supplier emails from their usual address: “We have changed banks; please pay this month’s invoice to the new account.” Their mailbox was compromised.
Understand it
How the Attack Works
Attackers compromise or imitate supplier mailboxes and insert themselves into real invoice threads. Because the conversation looks normal, the only reliable check is outside email.
Red flags
Warning Signs
- Bank detail changes requested by email, especially near payment dates.
- Slight changes in sender domain, signature or tone.
- Requests to keep the change quiet or to pay urgently.
Safer habits
What to Do Instead
- 1Verify bank changes by calling the supplier on a number from your records.
- 2Require two-person approval for new payees and bank changes.
- 3Hold payments when anything about the request is unusual.
Response playbook
Already Interacted?
For work accounts and devices, report promptly through your organisation’s IT or security process first. Never share passwords, codes or tokens in a report.
If you: sent a payment or changed bank details
- 1Contact your bank immediately and ask for a recall of the transfer.
- 2Inform finance leadership and IT or security the same day.
- 3Keep all emails, invoices and call records as evidence.
Knowledge Check
What Would You Do?
The supplier’s email includes a phone number “for confirmation”. Is calling it enough?
Fictional example for learning. Not a test score or certification.
Sources
- CISA: Phishing Guidance, Stopping the Attack Cycle
- FBI IC3: Criminals use generative AI to facilitate fraud (Dec 2024)
Content reviewed by WazuGuardix on 5 October 2026. Summaries are in our own words.
Make Safe Habits Part of Your Culture
Plain-language awareness sessions for everyday staff, developers and business teams.