Invoice fraud
What to do when invoice bank details change
A new account can be legitimate, but it can also indicate an altered invoice or compromised email. Confirm the change through a channel independent of the message that requested it.
Warning signs
When to stop and verify
- The account changed without prior notice, a contract change or a known business reason.
- The message pressures you to pay immediately or keep the change confidential.
- The sender address differs slightly from the supplier's usual address.
- The recipient name or IBAN country has no clear connection to the supplier.
- Formatting, logos, totals or other details differ from previous invoices.
Safer next steps
What to do before paying
- 1Call a previously verified supplier number, not a contact listed in the suspicious message.
- 2Compare the account, sender, amount and document layout with earlier invoices.
- 3Check published business or VAT details where an official register provides them.
- 4Pause the payment until an authorised person confirms the change independently.
Evidence for a check
What to submit to VerifyBeforeBuy
Business email compromise exploits an existing commercial relationship. Independent confirmation using a contact known before the change is more reliable than replying within the same email thread.
- The new and previous invoice
- The email requesting changed payment details
- Company, VAT, IBAN and recipient details
- The underlying order or contract
Frequently asked questions
Clear answers
Can I reply to the email and ask for confirmation?
That is not enough. If the mailbox or thread is compromised, the attacker can answer. Use a previously known phone number or separate channel.
Is a foreign IBAN automatically fraudulent?
No, but an unexpected country change without a credible business reason needs strong independent verification.