The invoice was real. The bank details weren't. That's how most payment-change scams work: a familiar vendor, a familiar amount, and one small change to where the money goes. The FBI counts business email compromise, the formal name for it, among the costliest crimes it tracks. AI makes it worse, because the email no longer has the typos and odd phrasing that used to give it away.
This guide shows how the scam works, the one rule that stops most of it, and what to do in the first hour if money already went.
How it works
The scammer doesn't need to break into your bank. They only need you to send a normal payment to the wrong account.
- They study you first. Vendor names, invoice styles and who approves payments are often easy to find or guess. Sometimes they get into a real vendor's email and read old threads.
- They copy something you trust. A reply in an existing email thread, an invoice in the vendor's usual layout, a sender address one letter off from the real one.
- They change one thing. "We've switched banks. Please use the new account below for this and future invoices."
- They add a reason to hurry. A late fee, an account on hold, an auditor waiting, a boss who needs it done today.
AI helps at every step: it writes in the vendor's tone, fixes the grammar, and produces a clean PDF in minutes.
The call-back rule
Never change where money goes based on an email, text or call alone. Call the vendor on a number you already have, and confirm the change with them.
That one rule stops most of these scams, because the scammer controls the email but not the vendor's real phone line. To make it work:
- Use the number in your own records, an old invoice or the vendor's official website, typed in yourself. Never the number in the message asking for the change.
- Ask an open question: "Did you send us a request to change your bank details?" Don't read the new details out and ask them to confirm.
- Have a second person approve any change to payment details before the first payment goes out.
- Write it down: who asked, when, who you called, what they said. The script at the end of this guide does that.
Red flags to stop on
None of these prove a scam on their own. Each one is a reason to call before you pay.
- New bank details, especially a new bank or a personal-looking account.
- Pressure to pay today, or a penalty if you wait.
- A reason not to call: "I'm traveling," "the phones are down," "just reply here."
- A sender address or reply-to address that differs, even slightly, from the one you usually see.
- A request to keep it quiet, or to skip your usual approval.
- A first-time request from a vendor who has never changed details before.
You can paste a suspicious email or invoice into our Scam Check to see the red flags. It doesn't replace the call. It tells you why to make it.
If money already went
Speed matters more than anything else. Banks can sometimes stop or reverse a transfer if they hear about it fast.
- Call your bank right away. Ask for the fraud team, say the payment was sent to a fraudster, and ask them to recall the transfer and contact the receiving bank.
- Report it to the FBI at ic3.gov, the FBI's Internet Crime Complaint Center. Include the amounts, dates, account numbers and the emails.
- Tell the real vendor, on their known number. Their email may have been broken into, and other customers may be at risk.
- Secure your own email. Change passwords, turn on two-step sign-in, and check for forwarding rules you didn't set up. Scammers often add one to read your mail.
- Keep everything. Don't delete the emails. Your bank, insurer and the FBI may need them.
Can this go into AI? An office manager wants to paste a vendor's email asking for new bank details into a scam checker.
Answer: Yes, once account numbers are masked. Checking the message is fine. The decision still comes from the call to the vendor's known number.
Key points
- The scam changes one detail on a normal payment: where the money goes.
- Call the vendor on a number you already have before any payment change. Never use the number in the message.
- A second person approves every change to bank details.
- If money already went, call your bank first, then report it at ic3.gov.
Payment change call-back script
Print this and keep it next to whoever pays the bills.
- Request received from [sender] on [date] by [email / text / call], asking to change [payment details].
- Call back on the number already in our records: [number from our files, not from the message].
- Script: Hi, this is [your name] from [Business Name]. We received a request to change your payment details. Did you send it?
- Confirmed by [name of person you spoke with] at [time]. Change is genuine: [yes / no].
- Second person check: [coworker name] reviewed and agreed on [date].
- If anything feels off (urgency, secrecy, a reason not to call), stop and tell [owner or manager] before paying.