A supplier's email gave us new bank details. What do we do?

Why is this the classic look-alike fraud?

The criminal, using a spoofed or compromised email account of the supplier, informs the business of a change in payment details. The email includes new banking information with instructions to send future payments to the "new" account which is actually fraudulent.

The RCMP describes this scheme: using a spoofed or compromised email account of a supplier, the criminal tells the business that payment details have changed and gives new banking information for future payments.

Your firm already expects the supplier's invoices, so a new account number in a familiar thread is easy to accept.

How do I check the sender?

check addresses on all emails requesting financial transactions/information, they may be slightly altered: i.e. if the real address is: [email protected] , the spoofed address might be: [email protected] .

The RCMP advises checking the address on every email that asks for a financial transaction, because it may be slightly altered, such as abc_123 in place of abc-123.

1. Open the full sender address, not only the display name.
2. Compare the domain letter by letter with earlier genuine emails from that supplier.
3. Do not use any phone number or link in the new email.

What do I do now?

1. Call the supplier at the number in your records and ask whether their bank details changed.
2. If they did not, keep the email and report it to the Canadian Anti-Fraud Centre, and tell the supplier their name is being used.
3. If a payment has already gone to the new details, call your bank's fraud line at once and ask about recalling the transfer.