We paid a supplier's new bank details and they were fake. What now?

What is this fraud?

A fraudster targets businesses that have an existing relationship with a supplier, wholesaler or contractors.

They send a spoofed email informing the business of a change in payment details.

What do I do now?

1. Call your bank and ask it to recall or reverse the payment.Use the first-hour page for your country below.
2. Call the real supplier on the number you had before the email.Tell them their name was used, and that the invoice is still unpaid as far as they are concerned.
3. Keep the email with its full headers.Do not reply to it.
4. Report it: in the United States at ic3.gov, in Canada to your local police and the Canadian Anti-Fraud Centre.

How do I stop the next one?

Make it a rule: no change of bank details until someone calls the supplier on the number already on file. Cyber insurance forms ask for exactly that rule.

Never make any payment changes without verifying with the intended recipient

What can an outside reading tell you after a payment fraud?

An outside reading cannot see your mailboxes, so it cannot tell you whether someone signed in to one.

It can show three things that bear on how a fraud like this reaches a firm: whether your DMARC record tells mail servers to refuse mail forged in your name, which look-alike domains of yours are registered, and which addresses at your domain are listed in breach data from other services.

Where do I go next?

• The first hour, United States
• The first hour, Canada
• The insurance form question on bank detail changes