People & Cyber Awareness
A familiar supplier has changed their bank details. What happens next?
Inxtinct Editorial Team · Oct 19, 2026 · 5 min read
An email arrives from a supplier the finance team knows. It refers to the correct invoice number and project. The wording is calm and professional. The message says their banking details have changed and asks whether this month's payment can go to the new account.
There may be no malicious link to click and no file to download. The request itself is the risk.
This is an illustrative scenario, not a report of an incident involving an Inxtinct customer. It shows why preventing payment fraud requires a business process, not just an instruction to “look out for suspicious emails”.
Why a familiar name is not proof
A criminal may imitate a supplier, compromise a mailbox or rely on information visible in earlier correspondence. An invoice number, signature and familiar tone can make an unexpected payment request feel routine.
The email might even come from a legitimate account if that account was compromised. That means checking the display name, spelling and sender address can help but cannot by itself settle whether the new instructions are genuine.
What matters is the requested change: money is being redirected to details you have not independently verified.
The safest first response is a process, not an accusation
Don't reply with the new account number and ask the same email thread whether it is correct. If the thread is controlled by an attacker, you've asked the wrong person to verify their own instruction.
Instead, pause the bank-detail change and use a separate, trusted contact method. Call the supplier using a number already in your approved supplier records or established through an independent process. Do not use the telephone number newly supplied in the suspicious message.
Record the outcome and follow your normal change-approval process. A genuine supplier should be able to work through it, even if it adds a short delay.
The NCSC's phishing advice similarly recommends independently contacting an organisation if you doubt who is communicating with you.
Build verification into accounts payable
A robust procedure should make the decision predictable. Decide who can create a new payee, who verifies bank-detail changes, which evidence is recorded and who can approve the payment. Where practical, separate those responsibilities.
For example, a finance coordinator receives a request. Another authorised person verifies the details using an existing trusted number. The result is recorded against the supplier and invoice. A payment approver reviews the change before funds are released.
The exact staffing may differ in a six-person company and a large finance department. Separation of duties is still a useful principle, even if the controls must be adapted to the team size.
Common pressure tactics and what they should trigger
“Our old bank account has been closed.” That is a reason to verify, not a reason to bypass verification.
“The director has already approved it.” Check through your usual approval channel; do not accept a forwarded name or screenshot as sufficient evidence.
“Please keep this confidential.” Confidentiality should not prevent necessary internal checks. A request to skip them is a warning sign.
“Payment must go today.” Urgency increases the importance of an agreed escalation process. It should not move the decision into an unrecorded chat.
Fraud does not always announce itself through dramatic language. A quiet, well-timed request can be more credible than a message full of threats.
If somebody has already changed the account
Act quickly. Alert your finance lead and bank using trusted channels, follow the bank's fraud-reporting procedures and preserve the relevant messages and transaction records. If funds have moved, ask the bank about urgent recovery steps. In the UK, reporting to the relevant fraud-reporting authority may also be appropriate.
Do not delete the email or begin improvising a private investigation that could interfere with evidence collection. Follow the organisation's incident response plan and bring in specialist assistance when needed.
The immediate questions are: Was money sent? Is any mailbox or account compromised? Are other supplier records affected? Could the attacker still send or receive messages?
A 20-minute exercise for your team
This is a useful exercise for finance, operations and anyone who can approve payments.
Minute 0–5: Show a fictional email asking to change bank details for an otherwise familiar invoice. Do not make the email cartoonishly suspicious.
Minute 5–10: Ask each participant what they would do next. Who do they contact? Which record do they use to find the phone number? Can they approve the change themselves?
Minute 10–15: Introduce a complication: the usual approver is travelling and the supplier says the payment is overdue. Ask whether your exception process still protects the business.
Minute 15–20: Agree on a simple rule and record the owner: Bank-detail changes must be independently verified through an established trusted channel before payment.
The exercise is successful if it reveals a gap in a real process and the team closes it. It isn't a contest to see who can spot a spelling error first.
What leaders should review afterwards
Check whether the supplier register contains current verified contact methods. Confirm whether your finance system records who changed payee details and who authorised payments. Make sure substitutes are defined for holidays and busy periods.
Then test the process occasionally. A rule that works only when one particular employee is available is fragile.
Inxtinct's cyber awareness workshops use realistic workplace requests to practise verification, escalation and decision-making. Inxtinct Learning can reinforce those steps with phishing activities and scenario-based learning. The lesson is simple: recognise the request, check it independently and make the safe action easy to follow.
