Scam library · Small business · Email & phishing · Banking & payment apps
Business email compromise: changed invoice bank details
A long-time supplier or contractor emails about an overdue invoice and mentions that their bank account has changed. The email looks normal and is in the same thread as earlier conversations.
Either the vendor's email was hacked, or someone registered a lookalike domain. Your payment goes to the scammer, and the real vendor is still waiting for it.
What the message looks like
From: Mike, Brightline Supplies <mike@brightline-suppplies.com>
Subject: RE: Invoice 4471, updated payment details
Hi, following up on invoice 4471 ($18,750). Our bank switched us to a new account due to an audit.
Please update your records with the attached details and send payment today if possible. Thanks so much!
How this scam works
Business email compromise is one of the costliest crimes the FBI tracks: $3.05 billion in reported losses in 2025. Small businesses are frequent targets because payments are often handled by one person without a second check.
Scammers study real invoices and writing styles. They may set up mail rules that hide replies from the real vendor so the scam stays secret for weeks.
The fix is simple and boring: a phone call to a known number before any change in payment details.
Write the verification step into your process so nobody feels rude doing it. A good rule: no change to payee bank details takes effect until someone has confirmed it by phone with a known contact, and a second person has approved it. Tell your vendors you work this way. Honest vendors appreciate it, because they're the ones who lose a payment when a scam succeeds.
If a vendor's email was hacked, let them know quickly so they can secure the account and warn their other customers.
Red flags
- Any change to bank details by email.
- A reason like 'audit', 'new bank' or 'tax issue'.
- Urgency to pay today, or a note that the sender can't take calls.
- A slightly different domain, or a reply-to address that differs from the sender.
- Unusual tone or attachments from a familiar contact.
How to tell it’s fake
- Call the vendor using a phone number from your records, not from the email, before changing bank details.
- Require two people to approve new payees or changed details.
- Watch for mail rules or forwarding you didn't set up.
What to do if you clicked, paid or shared info
Don’t panic, and don’t blame yourself. These scams are built by professionals. Act quickly, one step at a time.
If you clicked a link or called back
- If you haven't paid, stop and verify by phone.
If you paid
- Call your bank immediately to recall the wire or ACH payment, then report to ic3.gov. Quick reports give the best chance of freezing funds.
If you shared personal info, a password or a code
- If your own email may be hacked, change passwords, enable multi-factor authentication and check for forwarding rules.
Where to report and get help (U.S.)
If a message seems legit and you’re still not sure, get a second opinion before you act. Reporting helps stop scammers, even if money can’t be recovered. If you are in danger, call 911.
- Your bank or card issuer
Call the number on the back of your card or on your statement, not one from the message. Ask them to stop or reverse the payment and to watch the account. - Federal Trade Commission (FTC) · ReportFraud.ftc.gov
Report the scam and get a step-by-step recovery plan. - FBI Internet Crime Complaint Center (IC3) · ic3.gov
Report scams that happened online, especially if money was lost. Include phone numbers, websites and payment details. - AARP Fraud Watch Network Helpline · aarp.org helpline
Free, for anyone of any age: trained volunteers help you sort out next steps. 877-908-3360, Monday to Friday, 8 a.m. to 8 p.m. Eastern. - IdentityTheft.gov · IdentityTheft.gov
If you shared your Social Security number or someone opened accounts in your name.
How Gmork Scam Guard would warn you
Scam Guard in Chrome and Edge on your computer reads payment emails you have open in Gmail or Outlook on the web. It flags changed bank details, lookalike vendor domains and pressure to pay today, and reminds you to call a known number. For a small business, that one warning can save a month of revenue.
Scam Guard can miss things, so the checks above still matter. See what it warns about and what it keeps private.
Questions people ask
- How common is business email compromise?
- Very. The FBI reported $3.05 billion in BEC losses in 2025.
- The email came from the vendor's real address. Is that safe?
- Not necessarily. Their account may be hacked. Always confirm bank changes by phone.
- What should I do right after a fraudulent payment?
- Call your bank to recall it, then report to ic3.gov right away.