A supplier says their bank details have changed. Is it a scam?
Treat it as a scam until a phone call proves otherwise. Call the supplier on a number you already had on file — not the number in the email — and confirm the change verbally. Genuine suppliers expect this call and will not be offended. If the email adds urgency, pressures you not to call, or arrives near a large invoice, the risk is higher again.
Why this specific email is so dangerous
A bank-detail change is the payoff step of a payment redirection attack. Everything before it — reading the mailbox, learning the invoice cycle, registering a lookalike domain — exists to make this one email believable.
It usually arrives from a supplier you trust, in a thread that already existed, written in the tone you are used to.
Check these before you do anything else
Compare the sender address character by character with an older, known-genuine email.
Check whether reply-to differs from the sender address.
Check whether the new account name still matches the supplier's legal entity name.
Check whether the change coincides with an unusually large invoice.
Check whether the email discourages a phone call, or gives a new number to call.
Then make the call
Use a number from a previous contract, your accounting system, or the supplier's publicly listed business number. Read the BSB and account number back digit by digit and have them confirm.
If you cannot reach them, do not pay. A delayed payment costs a phone call. A redirected payment costs the invoice.
If you already paid
Call your bank's fraud line immediately and ask for a recall on the payment, then report to Scamwatch and ReportCyber. Recovery depends almost entirely on how fast you move.
Common questions
Are supplier bank detail changes ever genuine?
Yes, they happen — businesses change banks or restructure. But they are rare, and a genuine supplier will always be happy to confirm the change over the phone.
What if the email came from the supplier's real address?
That does not clear it. Compromised mailboxes are the most common form of this attack, and the email genuinely comes from their account. Only a phone call on a previously known number settles it.
Should I ask for the change on company letterhead?
Letterhead proves nothing — it is trivially copied and the attacker already has real documents. A verbal confirmation on a known phone number is the only check that works.
Make the check automatic
RILLA Shield scans invoices and payee details before payment, flags supplier bank changes, and can hold a pay run automatically when something looks wrong.