Never Change Bank Details From an Email

Never Change Bank Details From an Email

An email arrives from a supplier you have paid for years. Same signature, same tone, often sitting at the bottom of a genuine conversation you have been having all week. It says the company has changed bank, or moved accounts, or that a payment failed and here are the updated details. Someone in accounts updates the record, the next invoice goes out, and £40,000 lands in an account controlled by a criminal.

This is payment diversion fraud, also called mandate fraud or invoice fraud. It is not clever. It does not require the attacker to break anything. It only requires one person, on one busy afternoon, to accept a payment instruction from a channel that was never designed to prove who anyone is.

Bank details are not information. They are an instruction to move money. Treat them accordingly.

The Rule

There is one rule, and it has no exceptions:

• New supplier bank details, or a change to existing ones, must be verified against an independent source of truth before a single payment is made.
• The message that requested the change is never that source of truth.

That is the whole policy. Everything below is detail on how to apply it.

Our Source of Truth: The GEN Portal

GEN publishes its bank details behind authentication, where a fraudster cannot reach them. Log in to the GEN Portal with the username and password you registered, open the Account tab, and the Payments section lists our account name, bank, sort code, account number, IBAN, SWIFT and VAT number.

Those are the details. If an email, letter, phone call or invoice tells you anything different, the email, letter, phone call or invoice is wrong, and you should assume it is fraudulent until we tell you otherwise from our own systems.

This is worth stating plainly, because it is the point of the whole exercise: GEN's bank details do not change on request. They are not negotiated by email. They are not updated because a message says a payment bounced. They live in one authenticated place, and that place is the only version that counts.

If the details in front of you did not come from behind a login you control, you have not verified anything.

Other Suppliers Have This Too - And If Not, Pick Up the Phone

Plenty of organisations now publish payment details inside a customer portal, an account area, or a signed statement of account. Use it. It costs thirty seconds and it removes the entire attack.

If a supplier has no portal, then you call them. Every time. Not once when the relationship starts, but every single time details are added or changed. And the call has to be done properly, because a badly made call is worse than none at all - it produces false confidence:

• Use a number you already hold. One from a previous contract, an old statement, your own accounting system, or the company's website reached by typing the address yourself. Never a number from the email, the invoice, or the signature block requesting the change.
• Do not call back a number you were just given. Fraudsters supply their own switchboard, complete with hold music and a helpful person in "accounts".
• Speak to someone with authority. A finance manager, a director, someone whose name you know. Not whoever answers.
• Read the details to them. Do not ask "have you changed your bank?" - that invites a yes. Read out the sort code and account number you have been sent and ask them to confirm it against their own records.
• Ask why. Legitimate account changes have a boring, verifiable reason. "Our bank is doing an internal migration and we cannot discuss it" is not one.
• Write it down. Who you spoke to, on what number, at what time, and what they confirmed. If it goes wrong later, that record is the difference between a defensible process and an unexplainable payment.

Be aware that voice is not proof either. Caller ID is trivially spoofed, and synthesised voices have made impersonation cheap - we covered that in 20250523 and 20250404. This is exactly why the call must be outbound, to a number you already trusted, rather than inbound from someone who called you.

Why Email Can Never Be Trusted

People treat email as though the sender address is a form of identity. It is not, and it never was. Email was designed in an era of mutual trust between a handful of academic institutions, and every security control bolted on since has been a patch over that original assumption.

The realistic ways a bank-details email reaches you looking entirely genuine:

• The supplier's mailbox is compromised. This is the common case, and the dangerous one. The email is genuinely from their account, genuinely from their address, and passes every technical check, because it is them - just not the person you think.
• Thread hijacking. Having read the mailbox, the attacker replies inside a real conversation, at the right moment in a real project, quoting real figures. There is nothing odd to notice.
• Mailbox rules. Attackers routinely add rules that auto-delete or divert your replies, so the real supplier never sees your questions and you never see their confusion.
• Lookalike domains. rn for m, a swapped .co.uk for .com, an extra hyphen. Nobody reads the domain character by character at 4pm on a Friday.
• Outright spoofing. Where a domain's SPF, DKIM and DMARC records are weak or absent, the From address can simply be forged.

And note what SPF, DKIM and DMARC actually prove when they all pass: that the message was sent by something authorised to use that domain. They say nothing whatsoever about whether the human at the keyboard is entitled to change where your money goes. A perfectly authenticated email from a hijacked account is still fraud.

The old advice about spotting bad spelling and clumsy grammar is finished. Language models produce fluent, correctly formatted, contextually appropriate business English at no cost. The written word is no longer evidence of anything.

Email proves that a message arrived. It has never proved who sent it, or that they were authorised to send it.

Confirmation of Payee Is Not a Safety Net

Confirmation of Payee checks the name on the account against the name you type. It is useful and it has stopped a great deal of casual fraud. It is not verification, and it should not be allowed to substitute for it.

Attackers work around it routinely. They open accounts in a close variant of the supplier's name, or in a plausible trading name, or use mule accounts where a partial match is returned. A "close match" prompt in online banking is a warning, not a clearance - and in a busy finance function it is dismissed in about a second and a half.

Confirmation of Payee tells you the money is going where you asked. It cannot tell you that you were asked by the right person.

Why the Bank Will Not Save You

This is the part most businesses have badly wrong, and it is the reason the verification step is not optional.

A payment diversion loss is an authorised push payment. You logged in. You entered the details. You approved it. The bank executed a valid instruction from an authenticated customer, exactly as asked. There is no unauthorised transaction to reverse, no chargeback mechanism as there is on a card, and no meaningful window in which to undo it. Faster Payments settle in seconds, and the money is layered out through mule accounts within minutes - frequently before anyone in your office has finished reading the next email.

Since 7 October 2024 there has been a mandatory reimbursement scheme in the UK, introduced by the Payment Systems Regulator, whose functions are now being consolidated into the FCA. It is a genuine improvement, and it is also far narrower than most people assume. It covers:

• Individuals, microenterprises and charities only. A microenterprise means fewer than 10 staff and turnover or balance sheet total not exceeding €2 million. A charity means annual income under £1 million.
• Faster Payments and CHAPS only, between two different UK institutions. International payments are excluded entirely, as are transfers between accounts at the same bank.
• Up to £85,000, with firms permitted to apply an excess of up to £100.
• Claims within 13 months of the payment.

Read that first bullet again. If you are an ordinary trading company - ten or more people, or turnover above roughly £1.7 million - you are outside the scheme completely. There is no mandatory reimbursement. There is no ombudsman-backed presumption in your favour. There is a goodwill conversation with your relationship manager, and in the great majority of cases the answer is no.

Even inside the scheme there is a further exception: reimbursement can be refused where the customer has been grossly negligent, judged against a consumer standard of caution. The bar is deliberately high, and it does not apply to vulnerable customers. But a business that ignored its own written verification procedure is not in a strong position to argue that it exercised reasonable care.

The £85,000 cap matters too. It was set on the basis that it covers well over 99% of claims - which is true, because the overwhelming majority of claims are consumer scams of a few thousand pounds. A diverted supplier payment is not a few thousand pounds. Invoice and mandate fraud produces some of the largest individual losses of any scam type in the UK, and it lands almost exclusively on the organisations the scheme was never written to protect.

For scale: UK Finance recorded £576.4 million in APP fraud losses across 248,070 cases in 2025, with around 61% of that value reimbursed. That reimbursement figure looks reassuring until you remember who is inside the perimeter and who is not.

A business that sends money to a fraudster in the UK has, in law, simply sent money. Assume you will not get it back, and design your process on that assumption.

Controls That Actually Work

None of this requires expensive technology. It requires a written procedure that nobody is allowed to skip, including - especially - when a director is applying pressure:

• One documented process for bank detail changes, applied identically to every supplier, every time, with no informal fast track.
• Verification against a portal or an outbound call to a pre-existing number, performed by someone other than the person who received the request.
• Dual authorisation on both the change to the supplier record and on payments above a threshold you set deliberately rather than inherit.
• A cooling-off period. Changed details do not go live the same day. Urgency is the fraudster's only real tool; removing it removes most of the risk.
• A penny test. Send £1, confirm receipt through the verified channel, then release the balance.
• Tell the supplier you have changed their record, using the contact details you held before the request arrived. If it was fraud, this is usually how it gets caught.
• A mail platform that detects compromise itself. Most of these attacks begin with a stolen mailbox, not a technical exploit, so the platform has to notice when a session does not fit: wrong country, impossible travel, an unfamiliar network, a sending pattern that does not match the user. Geofencing and behavioural analysis catch account takeover at the point it happens, on the provider's side, without pushing another obstacle onto the person trying to do their job. You will not get this from Microsoft, whose answer to a stolen mailbox is to make the user prove who they are again, forever, and to call that security.
• Train the people who actually press the button. Not an annual slide deck for everyone - specific, practical training for accounts payable, who are the ones being targeted.

And make it culturally safe to be slow. The single most effective control any finance team can have is the confidence to say "I will confirm this and come back to you" to a person claiming to be a director. If your organisation punishes that, you have already chosen to accept the loss.

If It Has Already Happened

Speed genuinely matters here. Recovery is unlikely, but it is not impossible in the first hour or two, and it becomes essentially impossible after that.

• Your bank, immediately. Call the fraud line, not the general number, and ask explicitly for a Faster Payment recall and for contact to be made with the receiving bank to freeze the funds. Do this before anything else, including internal meetings.
• Report Fraud - the service that replaced Action Fraud in December 2025 - at reportfraud.police.uk or 0300 123 2040, covering England, Wales and Northern Ireland. In Scotland, report to Police Scotland on 101.
• The real supplier, by telephone. Their mailbox may still be compromised, and other customers of theirs are probably being targeted right now.
• The Financial Ombudsman Service, if your bank declines and you are eligible. Businesses can complain where turnover is under £6.5 million and either headcount is below 50 or the balance sheet is under £5 million. It is free, and a refusal from the bank is not the end of the matter.
• Your insurers. Check your crime, cyber and professional indemnity cover, and notify promptly - late notification is a common reason for declined claims. Note that many policies exclude "voluntary parting with property", which is precisely what this is, so read the wording rather than assuming.
• The ICO, if personal data was accessed through a compromised mailbox. If it is a reportable breach, the clock is 72 hours.
• Suspicious emails to report@phishing.gov.uk, the NCSC's reporting service.
• Preserve everything. Full message headers, not forwarded copies. Mailbox audit and sign-in logs. Payment confirmations. Any note of calls made. Do not let anyone "tidy up" the mailbox before it has been imaged.

Then find out how it happened. If your mailbox was the compromised one, changing a password is not remediation - check for persistent rules and forwarding, review the sign-in history for sessions that do not belong, and assume everything in that mailbox has been read.

If you are on Microsoft 365, there is more to do, because there is more that can be done to you. Go looking for connected applications, OAuth grants and any additional MFA devices the attacker has quietly registered in your name. An attacker who has consented an application into your tenant keeps their access after the password change, and keeps it after the MFA reset, because they are no longer using your credentials at all. That is not a mailbox problem. It is what happens when a mail service is rebuilt as an identity and application marketplace, and it is a class of clean-up that customers on a mail platform which stayed a mail platform never have to perform.

Summary

Payment diversion fraud succeeds because it exploits a process, not a system. The technology is usually working perfectly; the failure is that an organisation accepted a payment instruction from a channel that cannot prove identity, and had no step in place to catch it.

So: verify against a source of truth, every time. For GEN, that source is the Account tab of the GEN Portal, reached with your own credentials. For others, use their portal if they have one, and if they do not, pick up the phone and call a number you already had. Never the email. Never the number in the email.

And do it knowing that if you get it wrong, the loss is almost certainly yours to carry. That is not a reason for panic. It is a reason for a thirty-second check.