Image of a paid invoice with a woman holding up her hand as if to say STOP

Your Vendor Just Emailed New Bank Details. Don’t Pay It Yet.

By[email protected]

Imagine this: it’s Thursday afternoon and your bookkeeper forwards you an email. It’s from a vendor you’ve worked with for three years. The subject line is the same invoice thread you’ve both been replying to for two weeks. Their signature block is right. Their logo is right. The invoice amount matches the quote.

There’s just one new sentence in the middle of the message:

“Quick note — we’ve switched banks. Please use the updated account details below for this payment.”

Nothing about that email feels like a scam. That’s exactly the point.

Here’s the short version. A request to change vendor bank details should never be approved based on the email that asks for it. Call the vendor back on a phone number from your own records — not one in the message — and confirm with a person you already know. This is the single most effective control available, it costs nothing, and it works because it moves validation out of the channel the attacker is using. If you’ve already sent the money, call your bank’s fraud line and file at ic3.gov immediately; the FBI can sometimes freeze funds, but only if you report fast.

Here’s what the rest of this post covers:

  • Business email compromise cost victims about $3.05 billion in 2025, and complaint volume jumped 15% after three flat years
  • The scam now arrives inside real email threads, which is why “check the sender” and “watch for typos” have stopped working
  • The fix is a phone call, not software — callback verification is associated with roughly 91% effectiveness in industry survey data
  • Your bank probably owes you nothing. A federal appeals court ruled that a bank’s own fraud system flagging the transfer didn’t count as knowing about it
  • Your cyber policy may cap this far below your policy limit — social engineering is usually a separate endorsement with its own sublimit
  • Recovery odds are getting worse, from a 73% fund-freeze success rate in 2022 down to 58% in 2025

Let’s dig in.

Vendor Payment Fraud Cost Businesses About $3 Billion Last Year

This scam doesn’t get the attention ransomware does.

In 2025, the FBI’s Internet Crime Complaint Center logged 24,768 business email compromise complaints with about $3.05 billion in adjusted losses. Complaint volume jumped 15% that year after being basically flat for three years running. Over the decade through 2023, the FBI’s own tally of this scam passed $55.5 billion in exposed losses worldwide.

And those are only the people who reported it.

Similarly, the FBI’s real estate category — mostly wire instructions redirected at closing, the same trick in a different suit — grew from $173.6 million in losses in 2024 to $275.1 million in 2025. That’s up 59% in a single year while complaint counts rose only 32%. Fewer victims, bigger hits.

There’s no ransom note here. No locked screen. Nobody breaks anything. The payer has sent the money to the wrong account. The payee never received it. And you are both out the amount of the invoice, because it is usually unrecoverable.

The Scam Now Arrives Inside a Real Email Thread You Recognize

Falling for this is not a competence problem, and I want to be clear about why.

The old version was a stranger pretending to be your CEO, asking for an urgent wire. Clumsy, and easy to spot once you’d heard of it. The current version is different.

According to a 2026 email threat research report, hijacked and fabricated email threads now make up about 28% of these attacks, surpassing traditional fake-executive impersonation for the first time. That’s an industry vendor’s figure rather than a government one, so hold the precise percentage loosely — but the shift it describes matches what I see in the field.

Thread hijacking means the fraudulent message arrives inside a real conversation. Either the attacker is genuinely sitting in someone’s compromised mailbox and replies in sequence, or they’ve set up a look-alike domain and forged the email convincingly enough, and included the right people, so that it looks like a real conversation. Then, they wait for someone to reply or pay.

The advice you’ve absorbed over the years stops working:

  • “Check if you know the sender.” You do know them. Or so it seems.
  • “Look for typos and bad grammar.” There may not be any because many check their emails with AI now.
  • “Watch out for urgency.” It may just seem like an unassuming administrative note, at first.
  • “Don’t click suspicious links.” There’s no link. There’s a routing number.

Voice has changed too. The FBI’s 2025 report tagged 135 business email compromise complaints as involving AI, totaling about $30.3 million — roughly 1% of the total. But the Bureau states plainly that the real figure is almost certainly higher, because most victims never learn the voice they heard wasn’t human.

For the ceiling on this: the engineering firm Arup lost about $25 million in Hong Kong after a finance employee joined a live video call where every other person on screen, including the CFO, was AI-generated. That was a large company with real controls, and the employee thought they were doing due diligence by getting on video.

Verify Every Bank Detail Change by Phone, Using a Number You Already Had

This is the control that stops nearly all of it, and it requires no software, no tech saavy.

No bank detail ever changes based on an email. You call the vendor back on a number from your own records, and you speak to a person you already know.

Not the number in the signature block of the new email. Not the number printed on the invoice. The number in your own files, from before this conversation started.

In the Association for Financial Professionals’ annual payments fraud survey, this callback discipline is cited by the majority of surveyed organizations and associated with roughly 91% effectiveness against business email compromise.

It works because the entire scam depends on you staying inside the channel the attacker is using — usually email. Every element of that email can be forged.

Build Four More Controls Around That Phone Call

Not only should you call to verify using a trusted number, but there are several other policy and behavior changes you should consider.

Require two people on any payment change. One person receives the request, a different person verifies and approves it. Attackers specifically look for situations where one person can do both — which in a small business is usually the default.

Treat your vendor list as a controlled document. Changes to bank details in QuickBooks, your bill-pay platform, or wherever you keep them should require the same callback and the same second signature as the payment itself. Log who changed what and when.

Ask your bank about Positive Pay and ACH filters. Most commercial banks offer ACH Positive Pay or ACH debit filters, which allow only pre-approved vendors to debit your account and flag or block everything else. Check-based Positive Pay matches presented checks against the list you actually issued. These typically run $10 to $50 a month at smaller banks.

Make it socially acceptable to slow down. This is the one people skip. People don’t want to slow things down or annoy someone, but that’s your own best defense. Say out loud that you would rather be called about ten legitimate invoices than miss the one that isn’t.

Who Pays When the Money Is Gone: Usually You, Not Your Bank

Most business owners assume there’s a safety net here. There generally isn’t.

In Studco Building Systems v. 1st Advantage Federal Credit Union, decided by the Fourth Circuit in 2025, the receiving bank’s own internal system had flagged a mismatch between the account name and the account number on the fraudulent transfer. The court held that an internal flag did not amount to the “actual knowledge” required under the Uniform Commercial Code, and the bank walked away without liability.

Insurance follows a similar pattern. Social engineering fraud is frequently not covered under a standard cyber policy — it usually requires a specific endorsement, and those endorsements often carry a sublimit far below your overall policy limit. A Texas federal court ruled in 2026 that a $250,000 sublimit with “regardless of the number of claims” language capped a business’s entire recovery at $250,000, even though the fraud played out across multiple separate payments. (If you carry a cyber policy, which I hope you do, pull it out this week and search for the words “social engineering” or “fraudulent instruction.” Find the sublimit. If you can’t find either, call your broker.)

What to Do in the First Hours After Sending a Fraudulent Payment

Speed matters more than anything else. Not tomorrow morning. Now.

  1. Call your bank’s fraud line immediately — not the branch, the fraud department — and ask them to initiate a recall and freeze. Use the phrase “business email compromise.”
  2. File at ic3.gov right away. The FBI runs the Financial Fraud Kill Chain, which can freeze funds at the receiving bank before they move on. The formal international pathway generally applies to wires of $50,000 or more, sent internationally, with a SWIFT recall initiated, within the last 72 hours. A separate domestic process exists without those same criteria.
  3. Report regardless of the amount or the timeline. FBI guidance is explicit. Don’t disqualify yourself because you think you’re under a threshold or past a deadline.
  4. Know the odds have been worsening. The kill chain’s freeze success rate has dropped every year since 2022 — 73%, then 71%, then 66%, then 58% in 2025 — even as the dollars at stake nearly doubled. Reporting fast is the biggest variable within your control.
  5. Assume a mailbox is compromised until proven otherwise. Yours or your vendor’s. Have your cybersecurity person check for forwarding and new inbox rules, accounts, look-alike domains. Reset passwords on the involved accounts and be sure to use multifactor authentication (those six digit codes) using an authenticator app or hardware key, or a passkey.
  6. Tell your vendor. If their mailbox is the compromised one, you are almost certainly not the only customer receiving these.

Eight Warning Signs Your Bookkeeper Can Spot Without IT Training

Print these warning signs and tape it near whoever pays your bills.

  1. A vendor “switched banks” and needs the change applied to a payment already in flight.
  2. The message comes inside a real thread you recognize, but the sending domain is subtly off — an extra letter, a hyphen, .co instead of .com. Check the actual address, not the display name.
  3. The request to change details arrives only by email or text, never on a call you placed yourself.
  4. The invoice is identical to past invoices from that vendor in every respect except the account number.
  5. A caller sounds exactly right but combines urgency, secrecy, and an unusual payment method. Treat that combination as the signature of the scam itself.
  6. Somebody asks you to skip your normal approval process “just this once.”
  7. A video call meant to confirm a payment has odd lag, strange shadows, or hands and faces that don’t quite behave.
  8. A first-time vendor invoices you for something nobody remembers ordering.

Few of these are technical. This is a process problem dressed up as a technology problem.

Questions People Ask About Vendor Payment Fraud

How do I know if a vendor’s request to change bank details is legitimate? Call the vendor on a phone number you already had on file before this request arrived, and speak with a person you know. Never use a phone number supplied in the email or on the new invoice. Never just email. If the request is genuine, a two-minute call confirms it. If it isn’t, that call is the only thing standing between you and the loss.

Who is liable if my business wires money to a scammer? In most cases, your business absorbs the loss. Under the Uniform Commercial Code, a receiving bank generally isn’t liable for a misdescribed wire unless it had actual knowledge of the mismatch. The Fourth Circuit held in Studco Building Systems v. 1st Advantage Federal Credit Union that a bank’s own internal fraud flag did not meet that standard. Because you authorized the transfer, consumer-style fraud protections typically don’t apply to a business wire. Note that we are not lawyers and are not providing legal advice — check with your own attorneys for guidance.

Does cyber insurance cover business email compromise? Often only partially. Social engineering and fraudulent instruction losses are usually excluded from base cyber coverage and require a specific endorsement, which frequently carries a sublimit well below the overall policy limit. Check your policy.

Can I get my money back after a business email compromise wire? Sometimes, if you act within hours. The FBI’s Financial Fraud Kill Chain can request a freeze at the receiving bank. However, success rates have steadily declined. Report at ic3.gov regardless of the amount.

What is thread hijacking in email fraud? Thread hijacking is when a fraudulent message is inserted into a real, or seemingly real, ongoing email conversation, either by an attacker operating from a genuinely compromised mailbox or by forging the quoted reply history. It defeats the usual advice about checking the sender and looking for poor grammar, because most of the message is authentic. Industry research put it at roughly 28% of business email compromise attacks in 2026.

How much does Positive Pay cost for a small business? ACH Positive Pay and ACH debit filters typically run about $10 to $50 per month at community and regional banks, and are offered as standard treasury management products. Ask your banker directly — these services are rarely offered proactively to smaller accounts.

Not sure your payment process would survive this?

Most small businesses have never actually tested it. If you’d like a policy review or help drafting one — who can change a bank detail, who verifies it, and what your bank and your insurance would actually do — book a free consult and we’ll walk through it together.

[Book a free consult]

Wednesday I’m covering something related and more personal: how someone takes over your phone number in an afternoon, and the free carrier setting almost nobody has turned on.

Sources

Similar Posts