Fiducio guide

Bank detail change scams explained

A bank-detail change scam — also called mandate fraud — is one of the most effective attacks on accounts payable. A message claims a supplier's bank details have changed, and the next payment is quietly redirected to the fraudster. Here's how it works and how to stop it.

What a bank detail change scam is

The fraudster poses as a supplier you already pay and tells you their bank account has changed — often citing a new bank, a merger, or an audit. The request looks routine because the rest of the invoice is correct. If your team updates the payment details without independent confirmation, the money goes straight to the fraudster's account and is usually gone before anyone notices.

Why it works so well

  • It uses a supplier relationship you already trust.
  • The invoice amount and reference are often genuine.
  • The email may come from a compromised or lookalike account.
  • It arrives in a busy AP inbox where changes feel normal.
  • There is pressure to keep supplier payments on time.

Red flags to watch for

  • Any email stating bank details have changed — treat every one as suspicious until confirmed.
  • A reply-to address or sender domain that differs slightly from the usual one.
  • New bank details supplied only inside a PDF attachment.
  • Urgency: "use the new account for today's payment".
  • A request to keep the change confidential or to skip the usual process.
  • Account name that does not match the supplier's registered business name.

How to verify before you pay

  1. Never confirm using the phone number or link in the email itself.
  2. Call the supplier on a trusted number you already hold — ideally the main office line, not a mobile from the email.
  3. Confirm the sort code, account number, and account name directly with a known contact.
  4. Update your records only after verbal confirmation, and note who confirmed it and when.
  5. Require a second approver before releasing the payment.

Apply the same routine to every bank-detail change so nothing slips through on a busy day.

How Fiducio helps

Fiducio compares the bank details on every incoming payment email against the verified record you hold for that supplier. If the sort code or account number does not match — or the details come from an unknown or impersonated sender — Fiducio raises a high-risk alert and opens a verification task before payment, rather than letting a plausible "our details have changed" email slip through. Learn more about invoice fraud in construction.

Protect your payments before the next invoice

Start a 30-day evaluation of Fiducio — monitor your accounts payable mailboxes for invoice and payment fraud. From £99/month ex VAT after the trial.

Related guides