Supplier changed bank details: what to do in the first hour

The email is polite, it refers to the right invoice, and it arrives at about the right point in the shipment. The supplier’s bank has changed, or their usual account is under audit, or there is a new entity for this quarter. Please remit to the account below for this shipment only.

By the time that email lands, the fraud is largely over. The work was done weeks earlier, in whichever mailbox was easier to get into, and the attacker has been reading the thread since. That is why the details are right. The request is the last step, not the first.

What it costs, stated flat

The FBI’s Internet Crime Complaint Center counts business email compromise as its own category, and 2025 was the worst of the last three years on both measures: 24,768 complaints and US$3,046,598,558 reported lost, against 21,442 complaints and US$2.77bn in 2024.

Divide one by the other and the average complaint is a little over US$123,000, which is the size of an ordinary container payment rather than the size of a corporate treasury. This crime is aimed squarely at the middle of the trade.

On the desks this site is written from, one such attempt on a single shipment was worth US$62,500. That is one event, not a rate, and it is not offered as one.

The four signals

Any one of these holds the payment until a person confirms the account on a channel you chose:

1. A look-alike sender domain. One character different, or a different suffix on the same name. It survives a glance and not a comparison against an older email in the same thread.
2. Bank details changing part-way through a live deal. Legitimate changes cluster at the start of a relationship, or at a year end, announced in advance. Mid-shipment is the fraud’s natural habitat because that is when a payment is due.
3. A beneficiary name that is not the contract party. The attacker usually cannot open an account in your supplier’s name, so the beneficiary is a company you have never heard of, often in a third country.
4. Urgency or secrecy. A deadline, or a request not to discuss it with the usual contact. That is the attacker managing the one thing that defeats them.

The fourth signal is worth dwelling on, because it tells you what the control is. The attacker is trying to stop you making a phone call.

The control is a callback, and it is not negotiable

Call the supplier on a number you already held, from your contract or your own records. Not the number in the email. Not the number in the signature block, the attachment, or the letterhead of the “bank confirmation” that came with it. Read the account number back digit by digit and get a yes.

This is old advice and it is still the only advice that works, because it is the only check that leaves the channel the attacker controls. Everything else stays inside it: a second email, a reply to the thread, a callback they offer to make.

What is new is how well the inside of that channel now reads. The 2025 IC3 report has a section on artificial intelligence that did not exist in early editions: 22,364 complaints carrying AI-related information, US$893m in adjusted losses, and a specific note that voice cloning is used to request wire payment. Businesses reported over US$30 million to BEC scams involving AI in 2025 alone.

Which means the call has to be one you placed. A voice that rings you is not evidence any more, and has not been for a while.

If the money has already gone

There is a recovery machine and it is better than most people in trade know. The IC3’s Recovery Asset Team runs a process called the Financial Fraud Kill Chain, which puts the FBI between your bank and the receiving bank fast enough to freeze the balance before it moves on. In 2025 it ran on 3,900 incidents covering US$1.16bn of attempted theft and froze US$679m of it, a 58% success rate.

It only works on transfers it hears about quickly. The IC3’s own instruction is blunt:

If you discover a fraudulent transfer, time is of the essence. Immediately, contact your financial institution and request a recall of the funds along with any necessary indemnification documents.

And then, regardless of the amount, file at ic3.gov with the full transaction details in the report. The complaint is what lets the FBI approach the bank at the other end. An importer who spends the first hour working out internally how this happened has usually spent the hour that mattered.

The part that sits on the desk, not in the bank

Everything above happens after a payment instruction has been believed. The question underneath it is why a changed account ever reached a payment run without being checked against the contract. On most import desks the honest answer is that nobody has the contract open while reading the mail.

That is the gap trade fraud screening software is for: reading every inbound message against the four signals above and against the counterparty and account already on file for that shipment, and holding the payment with the reason written out. It is not a bank control and it does not replace the callback. It is the thing that notices the callback is due.

The same records do the other half of the job. When the beneficiary on an instruction can be compared, in one place, against the party on the purchase contract and the account that was paid last time, payment diversion fraud stops being a judgement call made by whoever opened the email.

What this post is not

It is not legal or banking advice, and the recovery figures above are the FBI’s, for complaints made to the FBI, mostly by US victims. A desk paying out of Singapore or Dubai has its own reporting route and its own bank’s recall policy, and the IC3 numbers are the best public measure of the crime rather than a description of your own jurisdiction’s process. Find out now what your bank does on a recall request, while nothing has happened.

The US$62,500 is one attempt on one shipment, and it is not claimed as caught by anything.

What travels everywhere is the shape: the email is the end of the fraud, the callback is the control, and the first hour after a payment is worth more than the following month.