An invoice with changed bank details can be genuine, but it is also a reason to pause. A familiar logo, an existing email thread or the correct invoice amount does not independently prove that the new recipient account belongs to your supplier.
The purpose of a verification workflow is to separate approval of the invoice from approval of the bank-detail change. You can owe the supplier money and still need to confirm where that payment should go.
What the FBI warning establishes
The FBI describes business email compromise as requests that appear to come from known sources, including fraudulent payment instructions. It recommends independently verifying changes in account numbers or payment procedures. If money has already been sent in a suspected scam, it advises contacting the financial institution immediately and reporting the incident.
Those are US reporting routes. Readers elsewhere should also use their bank’s urgent fraud process and the appropriate local reporting authority. A report is not a guarantee that funds will be recovered.
Separate three decisions
| Decision | Evidence to check | Keep it separate from |
|---|---|---|
| Is the invoice owed? | Contract, delivered work and agreed amount | Whether the new account is authentic |
| Who authorised the change? | Confirmation through a previously verified contact route | An email signature or urgent request |
| What account should be paid? | Recipient details confirmed by the authorised supplier contact | A new phone number included in the change email |
Use a phone number or other contact route already established independently of the change request. Replying to the same potentially compromised thread can send your question straight to the attacker. If you cannot reach a known contact, postpone updating the payment record until you can verify it.
A callback script for a small business
“We received an instruction to change the payment account for invoice [reference]. I am calling on the contact number we already hold. Did your organisation authorise this change? Please confirm the relevant invoice and account details through our agreed verification process.” Do not ask the caller to supply a password or a one-time banking code.
Illustrative scenario: a contractor sends a €2,800 invoice. A later message says its usual bank is undergoing an audit and demands payment to a replacement account today. The payer verifies the request through the contractor’s previously recorded number before changing the saved beneficiary. The amount and urgency are context, not proof of legitimacy.
Keep a change log
Record the date of the request, who verified it, which independent route was used and which beneficiary record was changed. A sole trader can use the same process without a finance team. For a team, make approval of a new beneficiary a distinct action from preparing the payment.
Do not rely on a small test transfer as proof of ownership: receiving a small payment does not establish that the recipient is the supplier. A name-checking tool can add information where available, but should not replace verification of an unexpected change.
If payment has already left
Contact the bank or payment provider immediately using its official security route. State that you suspect fraudulent changed instructions, provide the transfer reference and request the available recovery actions. Preserve the original messages, attachments and timestamps. Do not pay a purported recovery agent who contacts you unsolicited.
If your email was compromised, secure it through the service’s recovery process and review affected payment conversations. For routine delivery issues rather than fraud, our payment-rails guide provides context. Cost comparison in our transfer guide comes after verifying the recipient.
Source and scope
Source checked on 7 October 2026: FBI: business email compromise. Examples and worksheets are illustrative editorial tools. Confirm the current instructions for your country, provider and product.
Illustrative featured photo: Anete Lūsiņa / Unsplash.