Supplier Payment Fraud: How Bank Detail Scams Work and How to Stop Them

Quick Answer

Why This Scam Keeps Working

Most importers picture fraud as a stranger selling goods that never arrive. The more common and more expensive pattern is simpler. You are already mid-relationship with a supplier you trust, an order is in progress, and a message arrives asking you to pay a different account.

The sums are large because trade payments are large. The FBI's Internet Crime Report recorded business email compromise losses of roughly 2.77 billion US dollars in its 2024 reporting year, and the bureau consistently ranks it among the costliest categories of cyber enabled crime (FBI Internet Crime Complaint Center). The lesson is that the bank is rarely the weak link, the instruction is. A route that captures beneficiary details once, at instruction, and confirms them before release removes most of the room an attacker needs. Trade payments are targeted precisely because a five figure or six figure transfer raises no eyebrows when it matches an open invoice.

Three conditions make supplier payment fraud easy to run:

• Predictable timing. Suppliers invoice at known points in the order cycle, and buyers expect bank detail changes to happen.
• Weak verification habits. Many buyers confirm a change by replying to the same email thread that announced it, which is the one channel the attacker controls.
• Payment finality. Once an international transfer is credited, recovery depends on the receiving bank's cooperation, and funds usually move out fast.

How the Bank Detail Scam Works, Step by Step

The mechanics are consistent across most cases.

1. Access or impersonation. The attacker either compromises a real supplier mailbox or registers a lookalike domain that differs by a character or a different top level domain.
2. Thread hijacking. They reply inside an existing conversation, quoting the correct order number, the correct contact name, and the correct invoice value. This is what makes the message convincing.
3. The request. A short, polite notice explains that the company has changed banks, or that a new collection account is now used for this region.
4. Pressure. A deadline appears, often tied to production slots, shipping cut offs, or a discount that expires.
5. Payment. You send funds to the new account. The real supplier later confirms the invoice is still unpaid.
6. Withdrawal. The receiving account is usually a mule account. Funds are moved onward within hours.

The critical detail is that nothing in the message is obviously criminal. There is no request for a password, no strange attachment, no lottery win. It reads like ordinary account administration.

The Five Variants Worth Knowing

1. The bank detail change notice. The classic version described above. It targets an invoice that is already due.

2. The lookalike domain. The address reads like your supplier but uses a different ending, or a hyphenated version of the company name. Check the full address, not the display name.

3. The insider or compromised finance contact. A real employee mailbox is used, sometimes with a genuine signature block and real invoice attachments. Only the bank details differ.

4. The fake platform or escrow page. A payment link imitates a known trade platform or escrow service. Money sent there never reaches a supplier. Alibaba publishes its own guidance on paying only through official channels and warns against off platform transfers (Alibaba.com). That guidance is sound, and it only covers payments made inside the marketplace. Once a payment leaves the platform, confirmed beneficiary details on a direct route are the only control left.

5. The overpayment reversal. A buyer receives a payment larger than the invoice from a "customer", is asked to refund the difference, and later the original payment is reversed as fraudulent. This one targets sellers rather than buyers, and it is common in service businesses.

Red Flags That Deserve a Stop

None of these proves fraud on its own. Each one justifies a pause and a phone call.

• Bank details arrive in an email when you already hold different details on file.
• The account name does not exactly match the supplier's registered company name.
• The new account is in a different country from the supplier's registered address, with no explanation.
• The message is short, urgent, and discourages a call.
• The reply to address differs from the from address, or the domain is a near miss.
• The sender asks you to keep the change confidential from your own team.
• Payment terms suddenly shift from a documented credit arrangement to a prepayment.
• The invoice number is correct but the layout, fonts, or bank block look slightly off.

A legitimate supplier will never object to a verification call. Resistance to verification is the single strongest signal in the entire list.

A Pre-Payment Verification Routine That Actually Holds

Build this into your accounts payable process so that it does not depend on who is at their desk.

Step 1: Freeze the bank detail record. Store approved supplier bank details in one controlled place. Any change requires a second approver, regardless of amount.

Step 2: Call back on a number you already have. Use the number on the signed contract or the supplier's verified website, never the number in the email requesting the change. Ask for a named finance contact and read the account details back to them.

Step 3: Match the legal name. The beneficiary account name should match the contracting entity. If the supplier trades under a different name, ask for the registered entity documentation and keep it on file. Registries such as Companies House in the UK show legal names and filing history for free. A registry check takes two minutes and is the cheapest control in the process. Holding one approved beneficiary record per supplier, and applying it to every transfer without re-keying, makes that check structural rather than optional.

Step 4: Check the domain properly. Look at the full address, then check when the domain was registered. A "supplier" domain created three weeks ago is not your supplier of four years.

Step 5: Put it in the contract. Add a clause stating that bank detail changes are only valid when confirmed by signed letter or a verified call with a named officer, and that verbal or emailed changes alone are not authority to pay.

Step 6: Start small. For a first payment, or a first payment to new details, send a small test amount and confirm receipt before releasing the balance. This is standard practice in trade and costs very little.

What To Do in the First 24 Hours After a Bad Payment

Speed matters more than diplomacy.

1. Call your bank immediately and ask for a recall or recall request on the outgoing payment. Provide the exact value date, amount, and beneficiary details.
2. Ask the beneficiary bank, through your bank, to freeze the receiving account. This is the step most likely to recover funds.
3. Notify the real supplier in writing so that production and shipping are not halted on a false assumption of payment.
4. Preserve everything: full email headers, the invoice file, chat logs, and call records.
5. Report the incident to the relevant national cybercrime authority and to the platform where the contact originated.
6. Review how the payment was released and change the process, not just the password.

Recovery rates fall sharply after the first day. Treat the first few hours as the only realistic window.

Where the Payment Route Fits In

Process prevents most losses, but the route you pay through determines what is visible before money leaves and what is possible afterwards.

A standard international transfer can pass through several banks, and each hop adds a point where details are re-keyed. When the beneficiary name, account number, and bank are confirmed once at the point of instruction, and the payment travels on direct conventional rails rather than a chain of intermediaries, there are fewer places for a detail to be altered or misread.

This is where DapsyPay fits for business payers. Payments run on standard international rails such as SEPA and ACH, with the beneficiary details captured and confirmed at instruction, transparent fees shown before you commit, no limits on payment size, and bulk sending built for teams paying many suppliers in one run. For an accounts payable team, that means one controlled payment file rather than a series of one off bank visits, and a cleaner audit trail when a supplier asks which account was credited.

It does not replace verification. It removes some of the friction that makes verification feel optional. Compared with a marketplace escrow that only protects payments made inside the platform, or a chain of intermediaries where details are re-keyed at every hop, a direct route narrows the space an attacker can work in.

If your exposure is on the receiving side instead, our guide to how correspondent banks affect a transfer explains why payments pass through so many hands, and our post on how trade finance works covers the instruments that reduce prepayment risk in the first place. Buyers comparing routes by total cost will also find our breakdown of FX conversion fees useful.

Common Mistakes That Cost Real Money

• Replying to the email that requested the change to "confirm" it.
• Trusting a WhatsApp number because it has the supplier's logo as a profile picture.
• Letting one person both create a supplier and approve its bank details.
• Assuming a large, well known supplier cannot be impersonated. Impersonation works precisely because the name is known.
• Skipping the test payment because the amount is large and the deadline is close.
• Failing to reconcile the bank statement against the invoice before confirming goods for shipment.
• Reporting the loss weeks later, after the mule account has been emptied.

Frequently Asked Questions

It is one of the most frequently reported categories of business email compromise, and trade payments are a preferred target because invoice values are high and timing is predictable. Official loss figures are published annually by national cybercrime agencies.

Sometimes, but only if you act within hours. Your bank can request a recall and ask the beneficiary bank to freeze the account. Recovery becomes unlikely once funds are withdrawn or forwarded.

Not necessarily. The supplier is often a victim too. Pause payments, verify details by phone, ask them to confirm the incident and their security steps, then resume with verified details and a stricter change process.

Different risks, not lower ones. Cards offer chargeback rights but carry fees and limits that make them impractical for large trade payments. Bank transfers are final, which is why verification before sending matters so much.

Ask for a bank letter or account confirmation document on the supplier's letterhead, call a known contact to confirm it, and compare the account name to the registered legal entity. Keep the evidence on file with the approved supplier record.

Conclusion

Supplier payment fraud is not defeated by suspicion. It is defeated by a boring, repeatable process: approved details in one place, changes confirmed by call, names matched, small tests before large sums, and a fast response plan for the day something goes wrong. Attackers rely on speed and urgency. A payment routine that pauses for ten minutes removes most of their advantage, and a route that keeps beneficiary details clean and traceable makes the remaining risk easier to manage.