Fake invoices and "our bank details have changed"
Two of the costliest scams look boring: an invoice you were not expecting, and a note from a supplier saying their bank details have changed. Both are quiet by design, because a payment sent to the wrong account rarely comes back.
The changed-bank-details scam
A supplier or contractor emails to say their banking information has changed, please use the new account for the next payment. The email may look exactly right, because the scammer may have been reading the real email thread first.
The change is the whole scam. The next legitimate-looking payment lands in the scammer's account, and it is often gone before anyone notices.
The surprise-invoice scam
You receive an invoice or a renewal notice for something you do not remember buying (antivirus, a subscription, a service). It may include a phone number to "dispute the charge", which leads to a scammer, or a link that harvests your details.
The goal is either to get you to pay a bill that was never real, or to get you on the phone where they can talk you into more.
The step that stops it
Never action a change to payment details, or a surprise invoice, from the message alone. Confirm it by calling the supplier or company on a number you already have on file, not one from the email.
For businesses, make dual approval and a verbal call-back the rule for any change of bank details. That one process defeats the entire scam.
The short version
- A "bank details have changed" email is a scam until verified by a known-good phone call.
- A surprise invoice is designed to make you pay, or to get you on the phone.
- Verify payment changes on a number you already have, never one from the message.
- For teams, require a verbal call-back before any change to supplier bank details.
Build the reflex, not just the knowledge.
BadgerQuest is a two-minute daily game that keeps this instinct sharp. Free for individuals, no card.
Play a round free →Training a team instead? See pricing · The same scam, aimed at law firms
Common questions
A supplier says their bank details changed. Should I update them?
Not from the email. Call the supplier on a number you already have on file (not one from the message) and confirm the change verbally. Email accounts get compromised, and a redirected payment is very hard to recover.
I got an invoice for something I never bought. What do I do?
Do not pay it and do not call the number on the invoice. If it references a real service you use, contact that company through its official website or app. If not, treat it as a scam and delete it.
How do businesses prevent payment-redirection fraud?
Make a verbal call-back to a known number mandatory before changing any supplier's bank details, and require a second person to approve. That process stops the scam even when the email looks perfect.