Key takeaways
- A message saying a supplier's bank details have changed is the classic route to invoice fraud. Treat every change as unverified until you've confirmed it by phone, on a number you already had.
- Business email compromise cost victims who reported to the FBI $3.05 billion in 2025. In the UK, invoice and mandate scams cost £41.3 million, 68% of it from business accounts.
- UK reimbursement rules for push payment scams cover individuals, micro-enterprises and charities, not larger companies, so most businesses carry the loss themselves.
- If you've paid a fraudster, call your bank at once and ask it to recall the payment. Speed matters: in 2025 the FBI's Recovery Asset Team helped freeze 58% of the money in the cases it handled.
The short answer
When a supplier says its bank details have changed, don't pay to the new account until you've confirmed the change by phone, on a number you already had, with someone you know at the supplier. The message may come from a hacked or look-alike email account, and the invoice may be the supplier's real one with only the bank details changed. Fraudsters use these messages because businesses pay large invoices routinely and rarely question a supplier they trust.
If you've already paid, call your bank immediately and ask it to recall the payment. The chance of recovering the money falls by the hour.
How the fraud works
The fraudster gets into, or imitates, the email of a supplier or of someone in your own finance team. They watch real conversations, then send a message that fits: a new account because of an audit, a bank change, or a tax issue, often with a real invoice attached and an urgent deadline. UK Finance describes the pattern as criminals posing as a supplier and "claiming that the bank account details have changed", often after intercepting emails or compromising an email account.
The FBI's definition of business email compromise (BEC) covers the same scheme and its variants: fraudsters compromise email, phone numbers or video meeting accounts, through social engineering or hacking, to redirect payments. The FBI notes that AI chat tools can quickly produce official-sounding emails, and that voice cloning can be used to request a wire, so wording and even a familiar voice are no longer proof. Businesses reported losses of over $30 million in 2025 to BEC scams involving AI.
What it costs
| Figure | Source | |
|---|---|---|
| BEC losses reported to the FBI, 2025 | $3.05 billion, from 24,768 complaints | FBI IC3 2025 report |
| BEC losses reported to the FBI, 2024 | $2.77 billion, from 21,442 complaints | FBI IC3 2025 report |
| UK invoice and mandate scam losses, 2025 | £41.3 million, from 2,305 cases | UK Finance |
| Share of those UK losses from business accounts | 68% (£28 million) | UK Finance |
| Share of UK invoice and mandate losses returned to victims, 2025 | 48% | UK Finance |
UK Finance says businesses are hit hardest because they "make genuine higher-value payments more regularly, making it harder to spot and stop a fraudulent one". Its 2025 figures were the lowest it has recorded for this scam type, which it attributes to continued investment in fraud prevention and customer education.
Who carries the loss. Since October 2024, UK payment providers have had to reimburse victims of authorized push payment scams, up to £85,000 per claim made within 13 months, but only for payments from personal, micro-enterprise and charity accounts, sent by Faster Payments or CHAPS to a UK account. Larger businesses aren't covered. In the EU, if your bank ran Verification of Payee and you authorized the payment after a warning, it isn't liable for a payment that reaches the wrong account.
A process for changed bank details
Write it down, give it to everyone who can change vendor records or release payments, and follow it every time.
- Treat any change as unverified, however it arrives: email, letter, phone call, a new invoice template or a message in your supplier portal.
- Call back on a number you already hold, from your vendor master file or a signed contract, never from the message. Speak to a contact you know, and ask them to confirm the new details by reading them out.
- Separate duties. The person who changes a supplier's bank details shouldn't be the one who approves payments to them, and every change needs a second approver.
- Check the new account itself. Paste a new IBAN into the IBAN checker: it shows the country, bank and BIC, so you can see whether the account is in the country and with the bank you'd expect. A UK supplier with a new account in another country is a reason to ask why.
- Use the name check. For euro and sterling payments, Verification of Payee and Confirmation of Payee compare the name with the account. Treat a no match or close match on a regular supplier as a stop sign, not a formality. See Verification of Payee.
- Send a small test payment first, and wait for the supplier to confirm, on the known number, that it arrived.
- Watch the timing. A change shortly before a large payment, or a request to rush, is the most common pattern. Hold the payment until the change is confirmed, and tell the supplier why: a real supplier will understand.
- Record what you did, who you called, on which number, and when, in the vendor record.
The same rules apply to crypto wallet addresses. A new address for USDT or USDC payments needs the same call-back, and a test transfer before the full amount. The wallet address checker shows which network an address belongs to, which catches a different class of mistake, but it can't tell you who owns it.
Red flags
- A change of bank details or wallet address just before a large payment
- Pressure to pay quickly, or to keep the change confidential
- A new account in a different country, or in a name that doesn't match the supplier's legal name
- An email address that's almost right, a reply-to address that differs from the sender, or a new phone number in the signature
- A request to split an invoice, or to pay a different entity "for tax reasons"
- Unusual tone or timing from someone you know, such as a message sent outside their working hours
If you've already paid
- Call your bank immediately. Ask it to recall the payment and contact the receiving bank. A recall works only while the money is still in the receiving account, so don't wait to investigate first. The FBI's advice is the same: "time is of the essence".
- Report it. In the US, file a complaint at ic3.gov with the full transaction details. The FBI's Recovery Asset Team runs a Financial Fraud Kill Chain with banks: in 2025 it handled 3,900 incidents involving $1.16 billion and helped freeze $679 million, a 58% success rate. Elsewhere, report to the police or your national fraud reporting service.
- Tell the real supplier, on the known number. Their email may be compromised, and their other customers may be targeted.
- Check your own email. If the fraudster got into your mailbox, change passwords, turn on multi-factor authentication, and look for forwarding rules you didn't set up.
- For stablecoins, report the transaction hash to the police straight away. Tether and Circle can freeze tokens while they're still at an address they can block, usually at the request of law enforcement. See what to do if you send USDT or USDC to the wrong address.
How this works with Align
Payments to suppliers from Align go out from named accounts in your company's name, in USD over ACH, Fedwire and SWIFT, EUR over SEPA and SEPA Instant, GBP over Faster Payments, and AED over UAEFTS and the Instant Payment Platform. Under Align's rules, payments to third parties go through your named virtual account, and Align may ask for the invoice behind a payment. Align's checks don't replace your own call-back: confirm any change of supplier details before you pay.
Sources
- FBI Internet Crime Complaint Center, 2025 Internet Crime Report (April 2026)
- UK Finance, Annual Fraud Report 2026 (June 2026)
- European Central Bank, Instant Payments Regulation (accessed November 2026)
- BaFin, Verification of payee (accessed November 2026)
- Pay.UK, Confirmation of Payee (accessed November 2026)
Common questions
- What's the safest way to confirm new bank details?
- Call the supplier on a phone number you already hold, such as the one in your vendor records or on a signed contract, and speak to someone you know. Don't use a number, link or contact from the message that announced the change, because the fraudster controls it.
- Will my bank refund me if I'm tricked into paying a fraudster?
- Not necessarily. In the UK, mandatory reimbursement covers Faster Payments and CHAPS transfers from personal, micro-enterprise and charity accounts, up to £85,000 per claim. Larger companies aren't covered. In the EU, if your bank ran Verification of Payee and you paid after a warning, it isn't liable. Many business losses are recovered only if the money is frozen before it moves on.
- Does Verification of Payee or Confirmation of Payee stop this fraud?
- It helps. Both check the name you type against the account, so a fraudster's account in a different name returns a close match or no match. But a fraudster can open an account in a similar name, and the check doesn't cover SWIFT payments from outside those schemes. A call-back on a known number is still the main control.
- Does the same apply to crypto wallet addresses?
- Yes. A supplier asking you to pay a new wallet address deserves the same call-back. Stablecoin transfers can't be reversed, and the issuer can only freeze tokens while they're still at an address it can block, usually after a request from law enforcement.
- Who should I report the fraud to?
- Your bank first, so it can try to recall the payment, then the police or your national fraud reporting service. In the US, file a complaint at ic3.gov with the full transaction details, which the FBI says can help it freeze funds.
This guide is general information, not legal, tax or financial advice. Rules and providers' terms change; check the sources linked above and take advice on your own situation.