Who this checklist is for
This bank details scam checklist is for owners and accounts people who pay suppliers, vendors or contractors. The scam is simple and it works on careful people: an email arrives that looks like it is from a supplier you already pay. It says their bank account has changed and asks you to send the next payment to the new one. Often it is a real email thread that was hacked, or an address that differs by one letter. The money goes to the scammer, and the real supplier is still waiting to be paid.
Use these checks every time anyone asks you to change where you send money, whether by email, a letter on letterhead or a WhatsApp message. The first few take seconds. The later ones are habits that make this scam very hard to pull off in your business. For checking money coming in, see our payment proof checklist.
The 10 checks, and why each one matters
Don't reply on the same email thread
If the thread has been hacked, your reply goes straight to the scammer, who will happily confirm the new account. Start a fresh conversation another way.
Spell-check the sender's email address
Read the full address, not just the name shown. Scammers use lookalike addresses with one letter swapped, an extra letter or a different ending.
Slow down when it says 'urgent'
"Pay today or the order stops" is pressure meant to skip your checks. A real supplier will wait a day while you confirm.
Never trust a PDF or WhatsApp alone
A letter on letterhead, a bank screenshot or a cancelled cheque image can be copied or edited in minutes. Treat them as a claim, not proof.
Two people approve any bank change
One person enters the new details, a second person checks and approves them. A rule like this stops one rushed moment from costing you a payment.
Send a small test payment first
After you have confirmed by phone, send a small amount and ask the supplier, on that same saved number, to confirm it arrived before the full payment.
Turn on 2-step login on your email
Many of these scams start with a hacked mailbox, yours or theirs. Two-step login on every work email makes a stolen password far less useful.
Get an alert when bank details change
Set your accounting tool or payment system to notify the owner whenever a supplier's bank details are edited, so no change goes through quietly.
Brief your accounts team on this scam
Show the people who make payments what this email looks like and make clear they will never be blamed for stopping to check.
Call them on the number you saved
The check that stops it. Call the supplier on a number you already had, never the one in the email or letter, and confirm the new details with someone you know.
Questions about bank details scams
How do I check if a supplier's bank change request is real?
What should I do if I already paid the wrong account?
Can automation help stop this kind of scam?
Who approves a bank change in your business today?
Book a digital audit. We will look at how supplier payments are approved today and show you where checks and alerts can be built in.
Part of our Supply Chain and Procurement hub. Start with our supply chain automation.