The message came from my supplier's usual address.

That's the most common case: the fraud follows a compromise of the supplier's mailbox, which makes the message technically authentic. Only a verbal verification on an already-known number can settle it.

The transfer has gone out — can I recover it?

It's possible if the alert is raised very early: the bank can attempt a fund recall as long as the destination account hasn't been emptied. Time is the deciding factor — call before doing anything else.

Fake bank details change

In plain terms

A regular supplier announces by email that it changed banks. The invoice is the same, only the account number changes. The payment goes to the scammer, and it's only noticed when the real supplier follows up.

Definition

The fake bank details change fraud consists of getting a regular payee's — supplier, contractor, landlord, employer — banking details changed, in order to divert an expected payment.

How it works

The attacker inserts themselves into an existing payment relationship, often after gaining access to one party's mailbox. They send a message announcing a change of bank, with a new account number and sometimes an invoice matching the usual formatting. Nothing looks urgent or unusual: the fraud's strength is precisely its ordinariness, since the payment was expected anyway. It's only discovered when the real creditor follows up, often several weeks later, once the funds can no longer be recovered.

Warning signs

Notification of a change in banking details received by email
New invoice identical to previous ones, except for the account number
Payee's bank different from the one used so far, or based in another country
Request made within an existing conversation thread, with no other change
Impossible to reach the usual contact at the time of the request

How to verify

Call the payee on the number you were already using before this message, never on the one shown in the message or on the new invoice. Get the change confirmed verbally, and first make a small test transfer that the payee confirms receiving.

What to do

Suspend the payment until verbal confirmation. Report the request to your accounting department, and warn the real payee: their mailbox may be compromised.

If it already happened

Contact your bank without delay to request a recall of the transfer, then notify the real payee and file a police report. Have the mailboxes involved analyzed, since the fraud almost always involves access to one of them.

Frequently asked questions

The message came from my supplier's usual address.: That's the most common case: the fraud follows a compromise of the supplier's mailbox, which makes the message technically authentic. Only a verbal verification on an already-known number can settle it.
The transfer has gone out — can I recover it?: It's possible if the alert is raised very early: the bank can attempt a fund recall as long as the destination account hasn't been emptied. Time is the deciding factor — call before doing anything else.

Official sources

Cybermalveillance.gouv.fr — Assistance and reporting (French government cybersecurity assistance service)

This article is part of the Financial fraud family. Last updated: 2026-08-31.