Supplier bank-detail change fraud: what to do with a new IBAN

Updated 3 September 2026

Supplier impersonation fraud — also called invoice redirection or payment diversion fraud — consists of posing as a regular supplier to hijack its payments: a message announces a "change of bank details", accounts payable updates the vendor record, and the next payment lands in the fraudster's account. The real supplier only notices when it chases the unpaid invoice, often weeks later. This guide is for whoever handles payments: recognise the attack, check the document you received, and above all follow the one procedure that defeats it.

Contents

1. How the attack unfolds
2. Warning signs in the message
3. What the attached bank-detail document reveals
4. The procedure that actually protects you: the call-back
5. If the payment has already gone out
6. What an automated check can and cannot do

How the attack unfolds

The fraudster starts with reconnaissance: who your suppliers are, who processes invoices on your side, when payments fall due. Websites, tender notices, professional networks and, increasingly, a compromised mailbox at the supplier itself provide all of it.

Then comes the impersonation. In the simplest version the message comes from a look-alike domain — a doubled letter, .co instead of .com, an added hyphen. In the most dangerous version it comes from the supplier's real, hacked mailbox, as a reply inside a genuine thread: sender, history and signature are all authentic. Only the bank details are not.

The trigger is a mundane pretext: a change of bank, a merger, an accounting reorganisation, "following an audit". A bank details document is attached, sometimes an invoice. Then the pressure: a follow-up call, a close due date, a discount for fast payment. Fake IBAN fraud is the document side of this scenario; "CEO fraud", where the urgent transfer order comes from a supposed executive, is its cousin.

Warning signs in the message

None of these proves fraud; any one of them is enough to trigger the verification described below.

• The sender address differs from the usual domain by one letter, or the reply address (Reply-To) is not the displayed sender.
• A new contact appears, or you are asked to stop going through the usual person, who is "on leave" or "has left".
• Urgency and secrecy: pay before a given date, keep it quiet, deal "directly".
• The new bank is in a different country from the supplier, or it is an online payment institution for a company that had always banked with a high-street bank.
• The supplier avoids the phone or only calls back from an unknown number.
• The message arrives right after a large invoice was issued or just before it falls due.

What the attached bank-detail document reveals

The document is the only tangible thing you hold. Three checks take a few minutes:

• The IBAN check digits (and the RIB key for a French account): a wrong key condemns the document. A valid key does not clear it — fraudsters open real accounts.
• Bank consistency: the bank code inside the IBAN, the BIC and the printed bank name must all point to the same institution; a major bank's logo over a payment institution's IBAN contradicts itself.
• Traces of editing: a font change on the IBAN line, a white rectangle covering the old number, a PDF revision later than its creation, PDF-editor metadata on a document supposedly issued by a bank. The guide on tampered invoices details each of these signals.

The procedure that actually protects you: the call-back

No check of the document can establish who owns the account. Only one thing can: asking the supplier, through a channel the fraudster does not control.

Call a number you already had — the contract, an old invoice, the vendor record, the official website — never the one in the message or the one printed on the document you just received. Speak to someone you know, or failing that to the accounts department, and have them read the IBAN back. If the supplier's mailbox is compromised, this is also how they will find out.

Write the call-back into a procedure: every change of bank details is approved by two people after a logged phone confirmation, and the first payment to a new account waits for that approval whatever urgency is claimed. Urgency is the fraudster's tool; the procedure is yours.

Since 9 October 2025, banks in the euro area check that the payee name entered matches the IBAN holder before executing a transfer. That is an extra net, not a reason to skip the call: the fraudulent account is often opened under a name close to the supplier's, or in the name of a shell company.

If the payment has already gone out

Every hour counts: the funds are usually withdrawn or moved abroad within hours or days.

• Call your bank immediately and request a recall of the transfer; the odds fall quickly but are not zero while the receiving account has not been emptied.
• Warn the real supplier: if its mailbox is compromised it must secure it and alert its other customers.
• File a police report and keep everything: e-mails with full headers, the bank-detail document, payment orders, call logs.
• Notify your insurer if you hold fraud or cyber cover, within the policy's deadlines.
• Review the internal process that let the change through, and report the attack to your national cybercrime service.

What an automated check can and cannot do

TrustyFile checks the document: IBAN check digits, consistency of company identifiers (SIRET, VAT), traces of editing, revisions, covered text. It catches the fabricated or altered bank-detail document, which is the most common case. It cannot know who owns a perfectly real account: that last link remains the phone call — and nothing replaces it.

Free tools

More guides