An email from a supplier says their bank details have changed, attaches an invoice that looks right, and asks you to pay the new account. Sometimes it's genuine. Often it's business email compromise (BEC), the fraud that cost US businesses over $3 billion in 2025 across 24,768 complaints to the FBI, second only to investment fraud.
The one rule that stops it
Never act on bank details from an email alone. Call the supplier on a number you already had, from a previous invoice, the contract or their website, not from the email. Ask the person you normally deal with to confirm the change.
The FBI's advice is the same: verify requests to change account information through a second channel. It works whichever way the email was faked, which matters because one of the two ways can't be spotted by looking.
The two ways it's done
1. A lookalike domain. The email comes from an address that resembles
the supplier's: [email protected] instead of acme-supplies.com,
rn instead of m, an extra letter, a hyphen. The fraudster registered it
days ago.
2. The supplier's real mailbox was hacked. The email comes from the genuine address, often in the middle of a real conversation, because the fraudster is reading it. Every technical check passes. Only the phone call catches this one.
Checks that take a minute
Before calling, these catch the first kind:
- Read the full address, not the name. On a phone, tap the sender name to reveal the address. The FBI specifically warns about checking on mobile devices.
- Compare it letter by letter with an address from an earlier, genuine email from the same supplier.
- Look at Reply-To. If replying would go to a different address than the one it came from, be suspicious.
- Watch for "via" or "on behalf of" next to the sender name in Gmail or Outlook: the message was sent by a different domain.
- Check the domain's age. Look the domain up at ICANN Lookup. A supplier you've paid for years doesn't send invoices from a domain registered last week.
Signs in the request itself
- New bank details, especially in another country or another name.
- Urgency: overdue, a penalty, a director waiting.
- A request to keep it quiet or not to call.
- Small changes in tone, signature or invoice layout.
Put it in your process
- Call-back for every bank detail change, on a known number, recorded with who confirmed it.
- Two people approve a change to a supplier's bank details, and a different person makes the first payment to the new account.
- Tell suppliers how you work, so a fraudster pretending to be you is also caught on their side.
If you've already paid
- Call your bank immediately and ask it to recall the payment. Speed matters: the first hours decide whether money can be stopped.
- Report it: in the US to the FBI at ic3.gov, in the UK to Action Fraud.
- Tell the supplier: their mailbox may be compromised.
Watch your suppliers' lookalikes
The lookalike kind is detectable before the first fake invoice: the domain has to be registered and set up to send email first. Nameward's supplier watch (Protect and MSP plans) monitors your suppliers' domains for new lookalikes that can send email and alerts you, so accounts can treat mail from them with suspicion. See also Someone is pretending to be my company for when it's your own domain being imitated.
Check a domain now
The lookalike domain checker lists registered lookalikes of any domain, how recently they were registered and which can send email.