The "We Changed Banks" Email: How Payment Redirect Fraud Hits Small Businesses

If you run a small business in Monterey County or anywhere on the Central Coast, you pay vendors every month: suppliers, contractors, landlords, accountants. Each of those payments depends on one fragile fact, the bank account on file. Attackers have noticed.

This guide explains how payment redirect fraud works, why it gets past smart people, and the short routine that stops it.

1. How the "we changed banks" scam works

The attacker's goal is not to break into your systems. It is to get you to change one line in your accounts payable records.

• They watch the invoice cycle. After reading a compromised mailbox, they know who you pay, how much, and when. The request arrives right before a real invoice is due.
• They reply inside a real thread. If a vendor's email account is taken over, the fake request appears in the same conversation as genuine invoices. Nothing looks out of place.
• They use a lookalike domain. A one-letter change in the sender address is easy to miss, as covered in our post on lookalike domains.
• They attach official-looking paperwork. A PDF on letterhead with new account details feels like proof. It is not. Anyone can make one.

This is a focused version of business email compromise. It also pairs with voice scams, since attackers sometimes follow up with a call, as described in our guide to voice clone wire fraud.

2. Why careful people still pay the wrong account

The fraud works because it looks like routine admin work, not an attack.

• Banks change. Vendors really do switch banks, so the request is plausible.
• Nobody feels responsible for the check. The person who updates the record assumes the sender is legitimate. The person who approves the payment assumes the record is correct.
• Money moves fast. Wire and ACH payments are hard to reverse. By the time the real vendor asks about the missing payment, the funds are gone.
• Email feels trusted. Email authentication reduces spoofing, and you can read more in our guide to SPF, DKIM, and DMARC. But a real, hijacked account passes every technical check.

3. A payment verification routine that stops it

You do not need new software. You need a short written rule that applies to every vendor, every time, including your largest and oldest.

• Verify by phone on a known number. Call a contact you already know. If you cannot reach them, the change waits.
• Require two people. One edits the record, a second approves the payment. Neither can do both.
• Treat any change as high risk. New account, new routing number, new payee name, or a move from check to wire all get the same check.
• Test before you trust. For large payments, confirm receipt of a small first transfer before sending the rest.
• Protect the mailboxes. Turn on multi-factor authentication and watch for a hidden forwarding rule in finance inboxes.
• Know your vendors' risk. A weak vendor is your weak point, as explained in our guide to vendor risk management.

The takeaway

Payment redirect fraud succeeds when one email can change where your money goes. Make that impossible: call back on a known number, split the duties, and log every change. If you want help locking down finance mailboxes and writing a payment verification procedure, see our cybersecurity and managed IT services, or check current pricing.

Frequently asked questions

What is vendor bank detail change fraud?

A criminal emails your accounts payable contact pretending to be a real vendor and says their bank account has changed. If you update the payment details, your next legitimate invoice is paid to the criminal instead of the vendor.

How do attackers know which vendors we pay?

They read compromised mailboxes, scrape public contracts and websites, or break into the vendor's own email. In that case the fake request can arrive inside a real invoice thread, which makes it look genuine.

How do we verify a change of bank account request?

Call the vendor on a phone number you already have on file, not one in the email, and confirm the change with a known contact. Record who confirmed it and when before anyone edits the vendor record.

Should one person be able to change vendor payment details?

No. Separate the person who edits vendor records from the person who approves payments. A second approval on every bank detail change removes the single point of failure that these scams rely on.

What should we do if we already paid the wrong account?

Call your bank immediately and ask for a payment recall, then report it to your IT provider and local law enforcement. Speed matters because recovery chances fall quickly once the money is moved.

Prefer to talk first? Email sales@ghosxt.com or call (831) 204-0501.