Before You Change Anyone's Bank Details

The email that looks completely normal

It comes from a vendor you pay every month, or a client, or one of your own employees. It's polite and a little boring. "We've changed banks. Please use the attached details for future payments." Or: "I opened a new account, can you switch my direct deposit before Friday?"

There's no bad grammar, no strange link, and no threat. Sometimes it's even a reply inside a real email thread you've been part of for months.

This is payment redirection fraud. The FBI's annual Internet Crime Report consistently ranks business email compromise, the category it falls under, among the most expensive crimes it tracks. It works because it doesn't look like fraud. It looks like paperwork.

How it actually happens

There are two common versions.

In the first, someone breaks into the real email account of a vendor, a client, or an employee. They read the old messages, learn who pays whom and when, and then send the bank change from the genuine address, right when a payment is due. Nothing about the sender looks wrong because nothing about the sender is wrong.

In the second, they register a lookalike address, one letter off or with "rn" standing in for "m," and copy the real person's signature and writing style. On a phone screen, most people never notice.

Either way, the money goes to an account the criminal controls, and it's usually moved out quickly. By the time the real vendor asks why they haven't been paid, it's gone.

Where small businesses get hit

• Vendor invoices. A supplier's "new bank details" arrive right before a large invoice is due.
• Payroll. An "employee" asks to change their direct deposit. The real employee finds out on payday.
• Client money. A property manager's owner payouts, a bookkeeper's client payments, an insurance broker's premium transfers. Anywhere you move money on someone else's behalf is a target, and it's also where a mistake hurts your reputation the most.
• Your own customers. Criminals also send fake "new payment instructions" to your clients, pretending to be you. Your clients pay the wrong account, and then they call you.

The one rule that stops it

Any change to where money goes gets confirmed by a phone call to a number you already had.

Not the number in the email. Not the number in the new signature. Not a reply to the same message. The number on file from before this request arrived, or one you look up yourself on the vendor's website.

That's the whole defense. If the email account is compromised, a reply goes straight to the criminal. A phone call to a known number goes to the real person, and the real person will tell you they never sent it.

A few habits make the rule stick:

• Write it down as a policy, even if you're the only one who pays bills. "We verify all payment changes by phone" is easy to say to a vendor who's annoyed by the call, and easy to hand to a new bookkeeper.
• Treat urgency as a warning sign. "Please update before today's payment" is exactly the pressure the scheme depends on.
• Slow down first payments to a new account. Many banks can add a second approval or a hold for new payees. Ask yours what it offers.
• Tell your clients how you'll never contact them. One line on your invoices, something like "We'll never change our payment details by email. Call us if you get a message that says otherwise," protects them and you.

If you've already paid

Call your bank right away and ask them to try to recall the payment. Speed matters more than anything else here, because the chance of getting money back drops quickly once it's moved on. Then file a report at ic3.gov, the FBI's Internet Crime Complaint Center, and tell the real vendor or client so they can check their own email account. The steps in The First Hour After You've Been Hacked apply here too.

The bottom line

One of the costliest scams a small business can run into doesn't look like a scam. It looks like a vendor updating their bank details.

You don't need to be able to spot it. You need one habit: any change to where money goes gets a phone call to a number you already had. It takes two minutes, and it's the difference between a slightly awkward call and a payment you'll never see again.