# How to check a supplier's email before paying an invoice

An email from a supplier says their bank details have changed, attaches an
invoice that looks right, and asks you to pay the new account. Sometimes
it's genuine. Often it's **business email compromise (BEC)**, the fraud that
cost US businesses over **$3 billion in 2025** across 24,768 complaints to
the FBI, second only to investment fraud.

## The one rule that stops it

**Never act on bank details from an email alone. Call the supplier on a
number you already had**, from a previous invoice, the contract or their
website, not from the email. Ask the person you normally deal with to
confirm the change.

The FBI's advice is the same: verify requests to change account information
through a second channel. It works whichever way the email was faked,
which matters because one of the two ways can't be spotted by looking.

## The two ways it's done

**1. A lookalike domain.** The email comes from an address that resembles
the supplier's: `accounts@acme-supplies.co` instead of `acme-supplies.com`,
`rn` instead of `m`, an extra letter, a hyphen. The fraudster registered it
days ago.

**2. The supplier's real mailbox was hacked.** The email comes from the
genuine address, often in the middle of a real conversation, because the
fraudster is reading it. Every technical check passes. Only the phone call
catches this one.

## Checks that take a minute

Before calling, these catch the first kind:

- **Read the full address, not the name.** On a phone, tap the sender name
  to reveal the address. The FBI specifically warns about checking on
  mobile devices.
- **Compare it letter by letter** with an address from an earlier, genuine
  email from the same supplier.
- **Look at Reply-To.** If replying would go to a different address than the
  one it came from, be suspicious.
- **Watch for "via" or "on behalf of"** next to the sender name in Gmail or
  Outlook: the message was sent by a different domain.
- **Check the domain's age.** Look the domain up at
  [ICANN Lookup](https://lookup.icann.org). A supplier you've paid for years
  doesn't send invoices from a domain registered last week.

## Signs in the request itself

- New bank details, especially in another country or another name.
- Urgency: overdue, a penalty, a director waiting.
- A request to keep it quiet or not to call.
- Small changes in tone, signature or invoice layout.

## Put it in your process

- **Call-back for every bank detail change**, on a known number, recorded
  with who confirmed it.
- **Two people approve** a change to a supplier's bank details, and a
  different person makes the first payment to the new account.
- **Tell suppliers how you work**, so a fraudster pretending to be you is
  also caught on their side.

## If you've already paid

1. **Call your bank immediately** and ask it to recall the payment. Speed
   matters: the first hours decide whether money can be stopped.
2. **Report it**: in the US to the FBI at [ic3.gov](https://www.ic3.gov), in
   the UK to Action Fraud.
3. **Tell the supplier**: their mailbox may be compromised.

## Watch your suppliers' lookalikes

The lookalike kind is detectable before the first fake invoice: the domain
has to be registered and set up to send email first. Nameward's
**supplier watch** (Protect and MSP plans) monitors your suppliers' domains
for new lookalikes that can send email and alerts you, so accounts can treat
mail from them with suspicion. See also
[Someone is pretending to be my company](/guides/someone-is-pretending-to-be-my-company)
for when it's your own domain being imitated.

## Check a domain now

The [lookalike domain checker](/tools/lookalike-domain-checker) lists
registered lookalikes of any domain, how recently they were registered and
which can send email.

## Sources

- [FBI IC3: 2025 Internet Crime Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf)
- [FBI IC3: business email compromise](https://www.ic3.gov/Home/BEC)
- [NCSC: business payment fraud](https://www.ncsc.gov.uk/section/respond-recover/business-payment-fraud)
- [NCSC: phishing guidance](https://www.ncsc.gov.uk/guidance/phishing)
- [Action Fraud: payment diversion fraud](https://www.actionfraud.police.uk/a-z-of-fraud/payment-diversion-fraud)

---
Source: https://nameward.app/guides/verify-supplier-email-before-paying (updated 2026-10-30)