Invoice fraud: stop "we changed our bank details" scams

In business email compromise (BEC), criminals hijack or imitate a supplier, executive or employee and ask you to pay a "new" bank account. Money sent by wire is rarely recovered.

Common versions

• A supplier emails to say their bank details changed for the next invoice.
• The "CEO" asks for an urgent, confidential transfer or gift cards for clients.
• An "employee" asks HR to update their direct-deposit account before payday.

Five controls that stop it

1. Call-back rule: confirm any bank-detail change by phone on a number you already had — never one in the email.
2. Two-person approval for new payees and large transfers.
3. Check the account: our bank account checker flags invalid IBANs and accounts in an unexpected country.
4. Lock down your domain: publish an enforced DMARC policy so nobody can send email as you — test it with our email spoofing checker.
5. Watch for look-alike domains of your company and your suppliers with brand protection.