An email arrives from an address you recognise, inside a thread you have been using, in the writing style you are used to. The invoice is right, the amount is right, and the only thing that changed is the beneficiary bank. This is the most expensive single email in international sourcing, and the defence against it costs nothing.
The short answer
- Treat every request to change payment details as fraudulent until you have proved otherwise on a channel the request did not come from. Not “be careful” — proved, on a different channel, using a number you already held.
- The usual checks all fail here, because in the common case the supplier's mailbox is compromised: the address is genuine, the thread is genuine, the invoice is a copy of a real one, and a reply asking “is this really you?” goes back to the attacker.
- The field that most often fails is the beneficiary name. A payment instruction where the account holder is an individual, or a company you have never contracted with, should not proceed on any explanation.
The pattern, described precisely
The request lands close to a balance payment, when your attention is on shipping dates rather than banking. The reason given is plausible and administrative: a new entity, an audit, a frozen account, a subsidiary in another jurisdiction. Nothing in the message is dramatic, because drama would be noticed.
This class of fraud is documented at national level — the FBI's Internet Crime Complaint Center publishes on business email compromise specifically, and it ranks among the costliest categories of reported internet crime. The reason it keeps working is not that buyers are careless. It is that every instinctive check happens inside the compromised channel.
Why the usual checks fail
Each row below is a check a competent buyer performs, and each one is defeated by the same fact: the attacker is reading the mailbox.
What you would normally check, and why it does not help
| What you would normally check | Why it does not help here |
|---|---|
| The sender's email address | Mailbox compromise means the address is genuine |
| The thread history | The message is a reply inside your real thread |
| The writing style | The attacker has read months of your correspondence |
| The invoice format | Copied from a real invoice you have already paid |
| The amount | Correct, because it came from the real order |
| Replying to ask “is this really you?” | The reply arrives in the compromised mailbox |
The six steps, in order
Run them in sequence. The order matters, because each step is only meaningful if the payment is still stopped.
Verification that actually verifies
| # | Step | What good looks like |
|---|---|---|
| 1 | Stop the payment | Nothing moves until step 6 clears, whatever the shipping pressure |
| 2 | Call a number you already had | From your own records or the contract — never a number in the new message |
| 3 | Speak to a named person you have spoken to before | Voice, not text; a stranger answering is itself a signal |
| 4 | Ask them to state the change without describing it first | If they cannot say what changed, it did not come from them |
| 5 | Check the beneficiary name against the contracting entity | A mismatch between account holder and the company on your contract is close to decisive |
| 6 | Confirm in a channel you opened, and write it down | A new thread you started, plus a record of who confirmed and when |
Three signals that stop the payment outright
Urgency attached to a banking change is the first. Real account changes are administratively boring and rarely urgent; urgency is a technique for removing the pause in which verification would happen.
A request to keep the change off the usual channel is the second — “please do not mention this in the group chat”, “the accounts team does not know yet”. Legitimate finance changes do not need to be hidden from the supplier's own staff.
A beneficiary name that does not match the entity on your contract or invoice is the third, including a “related company” you cannot verify exists. This one does not need a judgement call: it is a mismatch of fact, and it is where most losses could have been stopped.
Controls to put in place before it happens
The point of a control is that it removes the judgement call at the moment of pressure. All five below are agreed once and cost nothing per order.
Five controls, and why each works
| Control | Why it works |
|---|---|
| Record bank details in the signed agreement | Creates a baseline that any change has to be reconciled against |
| Agree in writing that changes require voice confirmation | Removes the decision from whoever happens to be paying that day |
| Keep one known-good phone contact per supplier, offline | The attacker controls the inbox, not your notebook |
| Route balance payments through one person | Fewer people to social-engineer, one habit to train |
| Treat the first payment to any new account as a test | A small amount, confirmed received by voice, before the balance moves |
If the money has already gone
Speed is the only lever. Contact your bank immediately and ask for a recall; the useful window is measured in hours, not days, and shrinks once the funds are moved onward. Ask the bank explicitly to attempt a recall of the specific transfer rather than reporting it generally.
Then report it — in the United States through the Internet Crime Complaint Center, and in other jurisdictions through the equivalent national channel — because recall requests initiated through official channels can reach the receiving bank faster than commercial ones.
Then tell the supplier, on a verified channel. Their mailbox is probably still compromised and you are unlikely to be the only buyer in it. That call is also the moment to reset the control: new confirmed details, in writing, in a thread you opened.
When the request is most likely to arrive
Three moments account for most attempts. The first is the balance payment before shipment, when the amount is large and attention is on the ship date. The second is just after a new contact person is introduced on either side, because an unfamiliar name makes an unfamiliar instruction look ordinary. The third is around a public holiday, when the people who would normally be asked are unavailable and the pressure to keep things moving is highest.
None of those is a reason to be suspicious of a supplier. They are the moments to apply the procedure without negotiating with yourself about whether it is necessary this time.
The mirror case: when it is your mailbox
The same fraud runs in the other direction, and brands discover it later because the loss lands on the supplier. If your own mailbox is compromised, a fake instruction goes out under your name — typically a request to ship goods to a new address, to release documents early, or to accept new payment details for a refund.
Two things reduce that exposure and cost nothing: multi-factor authentication on every mailbox that touches orders, and a standing agreement with suppliers that changes of address, banking or document release require voice confirmation from a named person on both sides. The second one matters most, because it makes the control mutual rather than something one party imposes on the other.
If it happens, tell the counterparty on a channel you have verified, change credentials, and check mailbox rules and forwarding settings — attackers commonly leave a rule that hides replies to the messages they send.
What to agree with your own bank, before anything happens
Half of the response to a diverted payment happens at your bank, and it happens faster if the groundwork exists. Ask three questions now rather than during the incident: who to contact outside normal hours, what the bank needs in order to attempt a recall, and how long their own process takes from the moment you call.
Two settings are worth having in place as well. Dual authorisation on outgoing payments above a threshold you choose puts a second person between an instruction and a transfer, which is precisely what the fraud is designed to avoid. And a payment cut-off habit — no transfers initiated in the last minutes of a working day — removes the window where a question cannot be answered before the money leaves.
Neither control is about distrusting your supplier. Both are about ensuring that the moment of payment is never the moment of decision.
The one-line version to put in your payment procedure
| Situation | What the procedure says |
|---|---|
| A request to change bank details arrives | Payment is stopped until voice confirmation is obtained on a previously held number |
| The beneficiary name differs from the contracting entity | Payment does not proceed, regardless of explanation |
| A change is confirmed | Details are amended in writing, in a thread we opened, and recorded against the supplier file |
| A first payment to a new account | Small test amount, confirmed received by voice, before any balance |
Quick answers
The email came from the address I always use. Is it still worth checking?
Yes. Mailbox compromise is the common case, which is exactly why a matching address proves nothing. The check that matters is a voice call on a number you already had.
What if the supplier is offended by a verification call?
A legitimate supplier will not be — they carry the same risk from the other side. If they are offended, you have learned something useful about how they handle money.
They sent a scan of a bank letter with a company chop. Is that enough?
No. A scan is an image, and images are the easiest part of this to produce. Verify the beneficiary name against your contract and confirm by voice on a number you already held.
Should I pay a mainland China supplier through an account in another jurisdiction?
It is common and not suspicious in itself. What matters is whether that entity appears on your contract and whether the arrangement was disclosed before the invoice rather than at the moment of payment.
Our supplier says their email was hacked and the real details are in the attachment.
Then the details arrive by voice, from a number you already held, and the new details go into a written amendment to the contract. Nothing that arrives through the compromised channel can be used to correct the compromised channel.
Does this only happen on large payments?
No, but the attempts cluster around balance payments because that is where the amounts are. A control that only applies above a threshold trains everyone to skip it below that threshold.
Sources
- FBI Internet Crime Complaint Center (IC3) — Business Email Compromise, how the scheme works
- IC3 — where to report an incident in the United States
- IC3 — Annual Reports, the published data on reported losses by crime type
- CISA — Avoiding Social Engineering and Phishing Attacks
- ICC — Incoterms® rules, where payment timing is tied to shipping documents
Sourcing styles for your line? The 2026 catalogue lists every ready-to-develop style — colorways, materials, quote list built in.