A supplier says their bank account changed, and the next invoice is due this week. Here is how to tell a routine update from a payment you will never see again.
The email looks completely normal. It comes from a vendor you have paid for two years, it references a real invoice number, and it politely explains that the company has switched banks, so please update the account on file before the next run. Nothing about it feels dramatic, and that is exactly the point. The quiet, believable version of this request is the one that empties an accounts payable budget, because it asks a busy person to change one field and move on.
Fraud that targets vendor payments is not a fringe problem. The FBI’s Internet Crime Complaint Center puts exposed losses from business email compromise at more than $55 billion across roughly 305,000 incidents between late 2013 and the end of 2023, and the “please update our banking details” variant is one of its most reliable forms. The good news is that these emails leave fingerprints, and most of them are visible before you approve anything.
The short version
A genuine bank-change request survives a phone call to a number you already had on file, and it never punishes you for making that call. A fraudulent one relies on a spoofed or look-alike address, a sense of urgency, and the hope that you will treat the new account details as part of the invoice instead of as a separate change that needs its own approval. Verify the change through a channel the sender did not give you, and the scam falls apart.
Table of Contents
Why these emails are landing more often in 2026
Two things changed recently, and both work in the scammer’s favor. Businesses now pay by ACH and wire far more than by check, which means a single changed account number can reroute a large payment instantly, with no envelope to intercept. At the same time, the writing quality of the scam itself has jumped. In September 2026, Microsoft’s threat researchers described an AI-assisted invoice fraud campaign that pushed more than a million emails over a few days in early August, most of them aimed at US finance teams, complete with professional-looking fake invoices and impersonated executives.
The takeaway matters for anyone reviewing payments. You can no longer rely on clumsy grammar or a fake-looking logo to give the game away, because the cheap tells are the first thing the automation fixed. The clues that still hold up are structural, sitting in the headers, the timing, and the account details rather than in the tone of the message.
1. The bank details changed, but nothing else about the relationship did
Real companies do change banks, but rarely, and almost never in the same week a large payment happens to be due. The most common shape of this scam is a first-ever banking update that arrives with unusual timing, right as a big invoice comes up in your queue. If you have paid a vendor into the same account for three years and the request to move it appears alongside their largest invoice of the quarter, treat the coincidence as the warning it usually is. Legitimate finance teams announce a bank migration early, in writing, and often more than once, because they want the transition to go smoothly on their end too.
2. The sender’s domain is off by a single character
Look-alike domains are the workhorse of this scam, and they are designed to pass a two-second glance. The display name reads correctly, the signature block is copied from a real email, and only the address itself has been altered by one quiet substitution. A recent example a supplier shared publicly involved a customer who almost paid a fake ACH-change request, then noticed the sender’s domain was off by a single letter and called first.
Hover over the actual address and read it character by character, because these are the swaps to expect:
| Real domain | Look-alike trick |
|---|---|
| acme-supply.com | acme-supply.co (dropped the final “m”) |
| northgate.com | northgabe.com (swapped “t” for “b”) |
| rivertoolco.com | rivertoolco-billing.com (added a word) |
| marlow.com | mariow.com (“rl” reads as “ri” in many fonts) |
3. The reply-to address does not match the from address
This one is subtle because the message can genuinely originate from the right domain while still routing your answer somewhere else. Scammers set a clean “from” name and a friendly signature, then quietly point the reply-to field at a free mailbox or a look-alike so that any question you send lands with them instead of the real vendor. Open the message details and compare the two fields directly. When the “from” says [email protected] but your reply would go to [email protected], you have found the tell, and no explanation in the email body should talk you out of it.
4. The request arrives inside a real, existing email thread
Here is the version that unsettles seasoned accounts payable staff the most. Sometimes the bank-change request is not spoofed at all. It comes from the vendor’s actual mailbox, quoted neatly under a genuine thread you started weeks ago, because the criminal is sitting inside that inbox reading the history. That is business email compromise in its purest form, and it defeats every check that only looks at the address, since the address is real. When a payment-instruction change shows up threaded onto old correspondence, assume the account may be compromised and verify by voice before you touch the vendor master file.
5. The email pushes you to move before you can check
Urgency is the oldest lever in fraud, and it survives because it works on good employees who want to be helpful. The message warns that the account is on hold, that a late fee kicks in today, or that a shipment will not release until payment clears into the new account. The Federal Trade Commission’s guidance for businesses is blunt about this pattern: scammers manufacture pressure precisely so you skip verification. A real vendor would rather wait one afternoon for you to confirm than watch a payment vanish into a fraudster’s account and start a recovery fight.
6. The new account name does not match the vendor’s legal name
When you do get the new banking details, read the account holder name before you read the numbers. Diverted funds often land in an account registered to an unrelated individual or a shell entity, because the criminal cannot open a business account in your vendor’s exact legal name. A supplier called Northgate Industrial should not be asking you to pay “J. Ramirez” or “Global Trade Holdings LLC.” Many banks now support account-name verification, sometimes called confirmation of payee, and if the name on the destination account does not line up with the business you actually buy from, stop and confirm through your known contact.
7. The invoice PDF itself looks slightly rebuilt
Attachments carry their own evidence. A fraudulent invoice is often a fresh document made to imitate a familiar one, so the letterhead sits a few pixels off, the font pairing is not quite the vendor’s usual set, or the totals are formatted in a style you have never received before. You can go a step further and check the file’s properties, since the author name, the creating software, and the creation date live in the PDF metadata and often reveal a document built yesterday by an account with no connection to your supplier. When the paperwork feels rebuilt rather than reused, trust that instinct enough to verify.
8. They discourage a call, or hand you a phone number to use
Pay close attention to how the email treats verification itself. A scam that has done its homework will try to own the confirmation step, either by discouraging a callback as unnecessary or, more cleverly, by helpfully including a phone number “for any questions about the update.” That number reaches an accomplice who will confirm everything you ask. The safe number is never the one printed in the email requesting the change. It is the one you already had before this message arrived, from a signed contract, a prior statement, or the vendor’s official website that you navigated to yourself.
9. The message is a little too polished, or polished in the wrong way
Perfect grammar used to feel reassuring, and now it can cut the other way. The AI-built campaigns Microsoft flagged produced clean, uniform, well-structured emails that were almost too consistent, with tidy formatting and generic corporate phrasing that did not quite match how your actual contact writes. If your usual rep at a supplier fires off short, typo-friendly notes and this bank-change request suddenly reads like a templated announcement from head office, the mismatch is worth a pause. Voice and rhythm are hard to fake convincingly for a person you correspond with regularly, so an odd shift in either is a soft signal that pairs well with the harder ones above.
How to verify a bank-change request in about a minute
The single most repeated piece of advice from accounts payable professionals is refreshingly simple, and it defeats almost every version of this scam. Treat any change to banking details as a separate event from the invoice, and confirm it out loud before you move a cent.
A tight verification routine looks like this:
- Call the vendor on a number you already had on file, or one you find yourself on their official site, and never the number printed in the request email.
- Confirm the change with a named person you can identify rather than whatever voice happens to answer, and ask a specific question the real contact would know.
- Require a second person to approve the update to the vendor master file, so no single employee can both receive the request and release the payment.
- Hold the payment until the change is confirmed in writing through that verified channel, and keep the paper trail with the vendor record.
That segregation of duties is what turns a lucky catch into a reliable defense. When one person enters vendor data, a different person confirms changes, and a third approves the release, a single convincing email can no longer walk a payment out the door on its own. The cost of the process is a short delay. The cost of skipping it, in cases where a city government or a mid-sized company confirmed the loss, has run well into six and seven figures.
What to watch for beyond the email
- A request to change the payment method entirely, for example from check to ACH or from ACH to a wire, alongside the account change.
- Follow-up messages that grow more insistent each day while still resisting a phone call.
- A new account at a bank in a different region than the vendor operates in, with no explanation for the move.
- Small “test” changes first, such as a new remittance email, that condition you to accept the bigger account change later.
This article is general information for business operations and fraud awareness, not legal or financial advice. Verify current procedures with your bank and a qualified professional, and report suspected fraud to your financial institution and the appropriate authorities promptly, since recovery windows for redirected payments are short.
Frequently asked questions
What is a “new bank details” invoice scam?
It is a form of business email compromise where a criminal impersonates a supplier, or takes over the supplier’s real inbox, and asks you to update the bank account on file so the next invoice is paid to an account they control. The money moves by ACH or wire and is difficult to claw back once sent.
How do I verify a vendor’s request to change bank details?
Call the vendor using a phone number you already had before the request arrived, such as one from a signed contract or a prior statement, and confirm the change with a named contact. Do not use any number or link in the change email itself, and require a second person to approve the update before payment.
The email came from the vendor’s real address. Can it still be a scam?
Yes. If a criminal has compromised the vendor’s mailbox, the request can come from the genuine address and even sit inside a real email thread. That is why voice verification through a known number, rather than an address check alone, is the control that actually holds.
We already paid a fraudulent account. What should we do now?
Act within hours, not days. Contact your bank immediately to request a recall or reversal, notify the real vendor, and file a report with law enforcement and, in the US, the FBI’s Internet Crime Complaint Center. Fast reporting is the biggest factor in whether any funds can be recovered.
Does a perfectly written email mean it is safe?
No, and in 2026 the opposite can be true. AI-assisted campaigns now produce clean, professional messages at scale, so polish is no longer proof of legitimacy. Judge the request by the account details, the sender headers, and independent verification, not by how well it reads.
What to do next
If a bank-change request is sitting in your inbox right now, do not reply to it, and do not update the vendor record yet. Find a phone number for that vendor from somewhere other than the email, call it, and ask a person you can name to confirm the change. Then write the rule down so it does not depend on one alert employee: every banking change gets verified by voice on a known number and approved by a second person, every time. For more on payment-fraud patterns, see our coverage of bank text alert scams and Zelle payment red flags, or browse the full Business section.
