Payment Redirection Fraud: Verify Bank Detail Changes
Payment redirection fraud, also called mandate fraud, does not need to hack your bank. It only needs one convincing message saying "our bank details have changed". Here is a written process for handling every bank detail change, so a single email can never move your money.
Key takeaways
- Treat every request to change bank details as suspicious until verified, however genuine it looks.
- Verify by calling a known number from your own records, never a number in the email, letter or invoice.
- Use a two-person rule and a cooling-off period before the first payment to new details.
- In the UK, pay attention to Confirmation of Payee results: a "no match" is a reason to stop.
- If money has gone, call your bank immediately and report it.
Payment redirection fraud works because it hides inside a completely normal business task. Suppliers do change banks. Finance teams do update records. Criminals simply insert themselves into that routine. They impersonate a supplier, a contractor, a landlord or even a member of staff, usually by email, and ask you to send future payments to a new account. Sometimes the message comes from a look-alike address that differs by one character. Sometimes it comes from the supplier's real mailbox, because that mailbox has been compromised, which makes it far harder to spot.
This guide focuses on one specific control: how to handle bank detail changes so that a fraudulent request fails, however good it looks. If you want the wider picture of business email compromise, including fake CEO requests, read our guide to stopping invoice fraud as well. This is general information, not legal or financial advice, so check with your bank on the protections it offers.
How payment redirection fraud usually unfolds
Knowing the pattern makes the warning signs easier to see. Most cases follow similar stages.
- Research: the criminal learns who your suppliers are, often from a compromised mailbox, public information or a previous invoice.
- Impersonation: they send a message from a real or look-alike address, matching the supplier's tone, logo and invoice layout.
- The change request: the message announces new bank details, often with a plausible reason such as an audit, a bank merger or a new finance system.
- Pressure: a payment is "overdue", the account will be put on hold, or the contact is about to go on leave.
- Cash-out: once you pay, the money is moved on quickly, which is why speed matters so much afterward.
Warning signs to train everyone on
- Any request to change bank details, especially by email or letter alone
- Urgency, secrecy or a request not to call because the contact is "in meetings"
- A sender address, reply-to address or domain that is slightly different from usual
- A new account in a different country or in a name that does not match the supplier
- An invoice that looks right but has a new bank section, or a PDF that has been edited
- A follow-up email "confirming" the change, which proves nothing if the mailbox is compromised
Common mistake
Replying to the email to ask "Is this genuine?" If the mailbox is compromised or the address is fake, the criminal will happily reply "Yes". Any check that uses the same channel as the request is not a check.
The verification process: a step-by-step policy
Write this down as a short policy and make it apply to everyone, including the owner. A rule that the boss can skip when busy is the rule a fraudster will target.
- Freeze: do not update the bank details or make any payment to the new account while the request is being checked.
- Find a known number: look up the supplier's phone number from your own records, such as the original contract, an earlier invoice you have already paid safely, or your supplier file. Never use contact details from the change request.
- Call and confirm: speak to a person you know, or ask for the finance contact through the switchboard. Read back the new sort code and account number, or ask them to read theirs to you, rather than asking "Is this right?".
- Record: note who you spoke to, the number you called, the date and time, and what was confirmed. Attach it to the supplier record.
- Second approval: a second person reviews the evidence and approves the change in your accounting or banking system.
- Cooling-off: wait a set period before the first payment to the new details, and consider a small test payment confirmed by phone before a large one.
- Notify the old contact: where practical, also tell the supplier's usual contact by phone that you have changed their details. A genuine supplier will not mind, and a fake request will be exposed.
Pro tip
Ask new suppliers for their bank details and a named finance contact with a direct phone number at onboarding, and store them in one place. When a change request arrives later, you already have a trusted number to call.
Use the tools your bank already gives you
Confirmation of Payee in the UK
UK banks offer Confirmation of Payee, a name check that compares the account name you enter with the name held by the receiving bank. You will usually see a match, a close match or no match. A close match may be an honest abbreviation, but a no match on a supplier you have just changed should stop the payment until you have called the supplier on a known number. Do not let staff click past a warning because the email said the name "may show differently".
Payment controls and alerts
- Set up dual authorization in online banking, so one person creates a payment and another releases it
- Use payment limits, and require extra approval for new payees or amounts above a threshold
- Turn on alerts for new payees and large payments
- Protect online banking and email with multi-factor authentication
Protect your customers from fake versions of you
Payment redirection fraud also runs in the other direction. A criminal may send your customers a fake invoice that looks like yours, with their bank details instead. Even though it is not your money, the dispute, the lost goodwill and the delay in getting paid all land on you.
- State clearly on invoices, quotes and your website that your bank details will not change by email, and that customers should call a known number to confirm any change
- Give customers your bank details at the start of the relationship, ideally in a contract or onboarding pack
- Protect your own email with MFA and set up alerts for new mailbox forwarding rules, which attackers use to watch invoice conversations
- Set up email authentication (SPF, DKIM and DMARC) on your domain to make it harder to send fake mail in your name
- If you learn your mailbox was compromised, warn customers by phone that they may receive fake invoices
Example
For example, imagine a small building firm, Hartley & Sons, receives an email from its timber merchant saying the merchant has moved banks and attaching a new invoice for £18,400 in the usual format. The office manager follows the written policy: she freezes the payment, finds the merchant's number on last year's signed credit agreement and calls the accounts team. They have not changed banks. The merchant later discovers one of its staff mailboxes had been compromised. Because the check took ten minutes and nobody skipped it, no money was lost, and the merchant was able to warn its other customers.
What to do if you have already paid the wrong account
Act within minutes, not days. The faster the bank hears about it, the better the chance of stopping or recovering the money.
- Call your bank's fraud line immediately using the number on your card or the bank's official website, and ask them to contact the receiving bank. In the US, ask about recalling a wire transfer.
- Report the crime. In England, Wales and Northern Ireland, report to Report Fraud online at reportfraud.police.uk or on 0300 123 2040. In Scotland, call Police Scotland on 101. In the US, report business email compromise to the FBI's IC3 at ic3.gov.
- Tell the genuine supplier by phone, so they can check whether their systems were compromised.
- Secure your own email if there is any chance the attack came through your mailbox: change passwords from a clean device and check for forwarding rules.
- Notify your insurer, since some cyber or crime policies cover payment fraud, sometimes only as an added option.
- Keep the evidence: the emails with full headers, invoices, call notes and payment records. Do not delete anything.
| Situation | First action | Then |
|---|---|---|
| Change request received, nothing paid | Freeze and call a known number | Record the result and get a second approval |
| Confirmation of Payee shows no match | Stop the payment | Call the supplier on a known number before trying again |
| Payment already sent | Call your bank's fraud line now | Report the crime and tell the real supplier |
| Customers received fake invoices in your name | Warn customers by phone | Secure your email and check for forwarding rules |
Your bank detail change checklist
- Written policy: no bank detail change without a call-back to a known number
- Trusted contact numbers stored for every regular supplier
- Call notes recorded against the supplier record
- Second person approves every payee change
- Cooling-off period and test payment for new details
- Dual authorization and new-payee alerts in online banking
- Confirmation of Payee warnings treated as a stop signal
- MFA on email and banking, with forwarding-rule alerts
- Invoices state that your bank details will not change by email
- Bank fraud line and reporting numbers on a printed contact sheet
Frequently asked questions
What is the difference between payment redirection fraud and invoice fraud?
They overlap heavily. Payment redirection, or mandate fraud, specifically means persuading you to send payments to a different account by impersonating someone you already pay. Invoice fraud is a broader term that also covers fake invoices for goods or services you never ordered.
Is an email from the supplier's real address safe?
No. If the supplier's mailbox has been compromised, a fraudulent request can come from their genuine address and even sit inside a real email thread. That is why verification must use a phone number from your own records.
Does Confirmation of Payee protect me completely?
No. It checks whether the name matches the account, which catches many redirection attempts, but criminals sometimes use accounts in names that look plausible. Use it alongside call-back verification and two-person approval, not instead of them.
Will my bank refund money lost to payment redirection fraud?
It depends on your bank, the payment type, your country and the circumstances, so do not rely on it. Call your bank immediately, ask what protections apply, and check your insurance policy for payment fraud cover.
Related reading
The bottom line
Payment redirection fraud succeeds when a bank detail change is treated as routine admin. Make it a controlled event instead: freeze, call a known number, record the result, get a second approval and wait before paying large sums. Tell your own customers that your bank details never change by email.
The process costs a few minutes per change. A single skipped check can cost an entire invoice, so write the policy this week and make sure it applies to everyone.
