Invoice Redirection Fraud: When a Supplier ‘Changes Bank Details’, the Call-Back to a Number You Already Hold Decides

The most dangerous invoice in the tray is the one that looks exactly right. An invoice redirection fraud supplier bank details change callback routine treats every change of bank details as a stop sign: the change is never actioned from the message that announces it, and the decision is made by one call to a number the business already holds. That single call stands between a routine payment and money sent to a stranger.

An invoice redirection fraud supplier bank details change callback rule that never bends

Start by making the rule absolute, in writing, for everyone who pays invoices. An invoice redirection fraud supplier bank details change callback rule says that no change to a supplier’s bank details is ever actioned from the email, letter or invoice that announces it, however familiar the sender looks and however urgent the wording. The rule has no exceptions for large invoices or long-standing suppliers, and no one may waive it alone.

1. Pause the payment the moment a change appears, and mark the invoice as held.
2. Find the supplier’s number in your own records, never in the message.
3. Call the supplier on that number and confirm the change in a conversation you started.
4. Ask for the new details in writing, on a channel you already use.
5. Record who verified the change, when, and on which number.
6. Only then update the saved details, for future invoices only.

How the Change Arrives: A Familiar Invoice With One Line Different

The message usually arrives inside a conversation the business already trusts. An invoice redirection fraud supplier bank details change callback check expects the change to look ordinary: the same logo, the same tone, the same invoice layout, with only the bank line different. Sometimes the mailbox has been entered without permission; sometimes the address is a near copy. Either way, the message is designed to be believed, not questioned.

That is why the check never depends on spotting a mistake in the message. A careful fraud leaves no spelling errors and no strange formatting, and a tired reader will not catch one changed digit in an account number. The defence is not sharper eyes; it is a separate channel, used every time, without exception.

The Call-Back: A Number You Already Hold

The call-back is the whole control, and it works because of two words: already hold. An invoice redirection fraud supplier bank details change callback habit rings the number from the supplier’s contract, from an older invoice, or from the phone’s own history, and asks a person the business has dealt with before to confirm the change. A number printed in that message proves nothing, because the same hand wrote both.

Keep the call short and ordinary. Confirm the supplier’s name, the invoice number, and the new details, and note the time and the name of the person who confirmed them. A supplier who is genuine will not mind the check, because the same pause protects their payment from being sent to a stranger by mistake. If the supplier cannot be reached, the payment waits: a genuine supplier would rather wait a day than have a customer pay a stranger, and the invoice stays open until the check is done.

What to Check Before the Money Moves

Before any changed details are used, check the shape of the request itself. An invoice redirection fraud supplier bank details change callback routine looks for the warning signs together: a change announced close to the payment date, pressure to pay at once, a new account in a different name, and a reason that cannot be checked, such as an audit or a system change. Any one is a reason to pause; two together are a reason to call first.

The same caution applies to the business’s own bank. Our guide to when the bank asks about cash deposits shows how to answer a genuine question from your own bank with records, quickly and calmly. A bank asking about your money and a stranger asking you to move it are very different things.

After a Suspicious Message: Records, Pauses and a Calm Next Step

A suspicious message is not a reason for panic, but it is a reason for paper. An invoice redirection fraud supplier bank details change callback record keeps the message itself, the invoice it arrived with, the number that was called, who answered, and what was said. If the message is genuine, the record shows it was verified; if false, it shows what was stopped.

Our guide to a screenshot is not a payment makes the same point about proof: a picture of a payment is not the payment, just as a message about new bank details is not the supplier. The US Consumer Financial Protection Bureau’s fraud guidance is a useful place to read about recognising and reporting suspected fraud.

FAQ

What if the supplier really has changed banks?

Then the call-back will confirm it in a minute, and the payment can go ahead on the verified details. An invoice redirection fraud supplier bank details change callback routine does not stop genuine changes; it stops unverified ones. A genuine supplier expects the call, because it protects their payment too.

Can a small first payment prove the new details are genuine?

No. A small payment only proves that the account can receive money, not that it belongs to your supplier. Only the call-back to a number you already hold connects the details to the supplier.

What if the email came from the supplier’s real address?

Treat it the same way and call back anyway. A mailbox can be entered without permission, and a message sent from the real address can still carry false details. The call-back works because it does not depend on trusting the message.

Who in the business should be allowed to change saved bank details?

As few people as possible, and only after the call-back has been recorded. Every change should carry a name, a date and the number that was called. Keep that note with the invoice, where the next person to pay it can find it.

Conclusion: One Call Stands Between You and a Vanished Payment

An invoice redirection fraud supplier bank details change callback routine is one habit that never bends: never act on the message that announces a change, and always call the supplier on a number you already hold before the money moves. The call takes minutes and defeats a fraud no careful reading can catch.

If money routines are one of several habits you are tightening this year, BCC Financial’s Cash Security guides apply the same discipline to till fraud, counterfeit notes and the daily count. Start with the number in your own records.

This article is general educational information only and is not financial advice. Every business’s circumstances differ, so consider seeking professional advice for decisions about your own business.