All scam guides

Fake invoices and changed bank details

A bill you don't recognise, or a supplier, landlord, lawyer or agent whose bank details have suddenly “changed”. How to tell, and how to check before you pay.

An email from [email protected]

Please note our bank details have changed. Kindly pay invoice #4471 ($8,420.00) to our new account below, and reply to confirm once done.

What it looks like

An email from [email protected]

Please note our bank details have changed. Kindly pay invoice #4471 ($8,420.00) to our new account below, and reply to confirm once done.

An email

From to me

Final reminder: invoice INV-20931 for $1,980.00 is overdue. View and pay: https://docs-invoice.example/INV-20931

An email, a few days before you buy a home

From to me

Change of wiring instructions for Friday's closing. Please wire the deposit to the account attached, not the one we gave before.

Examples. The names and amounts change; the shape doesn't.

How to spot one

  1. New bank details, by email. Real companies rarely change them, and don't change them by email alone.

  2. A rush, or a reason not to call. “Overdue”, “today”, “I'm in meetings, just email me”.

  3. An address that's almost right, with one letter changed or a different ending. But scammers often write from a real mailbox they've broken into, so a right address proves nothing either.

  4. A bill for something you didn't order, with a link or a file to open. The file may be harmful.

What to do

  1. Don't pay, and don't reply or use the numbers in the email.

  2. Check orders, invoices and bank changes with the company directly. Call them on a number you already have, not one in the message.

  3. At work? Tell your finance team or IT, even if you didn't pay.

  4. Still not sure? Check the message. We open its link on a phone and a computer, not yours, and tell you what it is.

  5. Report it. If you paid, tell your bank first, then your police or your country's fraud reporting service.

    In the US: ReportFraud.ftc.gov (the FTC's website, opens in a new tab)

Why it works

It arrives in the middle of real work, sometimes in a real email thread, when you expect a bill. Nothing looks wrong except the account number.

Similar scams