A supplier has changed their bank details. What should you check?

Why this needs care

A request to pay a different account is a well-known way of tricking a business into sending money to criminals. Report Fraud, the UK's reporting service for fraud and cyber crime, calls it mandate fraud or payment diversion fraud.

The message may come from an address that looks almost identical to the real one. It may also come from the supplier's real email account, if a criminal has got into it. Microsoft describes attackers breaking into genuine mailboxes and reading the correspondence before sending a payment request.

So a familiar name, correct spelling, the right logo or a reply inside an existing email thread does not prove that a request is genuine.

Checks to make before changing anything

1. 1.Pause. Do not update the payment record or pay the new account while you check.
2. 2.Find the supplier's contact details from a source you already trust: your own records, a signed contract, or an earlier invoice you know was genuine.
3. 3.Contact them using those details and ask them to confirm the change. Do not reply to the message, and do not call a number given in it.
4. 4.Follow your approval process for changing supplier details. A second person should check and approve the change.
5. 5.Once you have verified the change independently, a small test payment that the supplier confirms receiving can be an extra check before a large amount is sent. It is never a substitute for verifying the change.
6. 6.Record who you spoke to, when, and what was confirmed.

Pressure is a reason to check

These requests often arrive with a deadline: an invoice is overdue, an account is closing, a discount ends today. Urgency does not prove fraud, because genuine suppliers chase payments too. It is a reason to verify carefully, and never a reason to skip the check. Keep the verification step even when the request is urgent.

Make the check routine

The check works best when it does not depend on one person's judgement on a busy day.

• Write down how changes to supplier bank details are handled and who may approve them. Report Fraud advises that only designated staff should be able to change payment arrangements.
• Hold verified contact details for each supplier somewhere other than your inbox.
• Tell suppliers how you confirm changes, so that the call is expected.
• Keep invoices and payment details where only the staff who need them can see them.

If a payment has already been made

1. 1.Contact your bank immediately, using the phone number on its official website or on your card, and explain what has happened. The sooner the bank knows, the more it may be able to do. Recovery of the money is not guaranteed.
2. 2.Tell the person responsible in your organisation and your IT administrator or IT provider. If the request came from a real mailbox, yours or the supplier's, that account may need securing.
3. 3.Tell the genuine supplier, using your trusted contact details, so that they can check their own accounts.
4. 4.Report it. In England, Wales and Northern Ireland, report to Report Fraud online or on 0300 123 2040. In Scotland, call Police Scotland on 101.
5. 5.Keep the messages, invoices and payment records. Do not delete them.

Be wary of anyone who contacts you afterwards offering to get the money back. Report Fraud warns that this is often a second scam.

When to involve your IT provider

Tell them about any suspicious request, even if no money has moved. They can check whether a mailbox has been accessed by someone else, look for sign-ins you do not recognise, and help you warn colleagues who may receive the same message.