← Artículos y guías sobre fraude, ciberseguridad, privacidad y PLD

Vendor payment fraud: a checklist to verify bank detail changes

Vendor payment fraud and BEC: a finance-team checklist to verify bank detail changes, run a proper callback and act fast if money already left the account.

2026-11-01

The email looks routine: a long-time vendor says it changed banks and sends new details for the next invoice. Sometimes it even comes from the vendor's real address, because their mailbox was hacked. That is the core of business email compromise (BEC), and the best defense is a simple process the finance team follows every time.

How big is vendor payment fraud?

The FBI IC3 2024 report counted 21,442 BEC complaints and $2.77 billion in losses. In the UK, UK Finance recorded 2,305 invoice and mandate scam cases and £41.3 million lost in 2025, 68% of it from business accounts.

How do I verify a bank detail change?

The FBI advises confirming requests by phone using a number from an independent source, agreed early in the relationship and outside email. J.P. Morgan warns about common callback failures:

Mistake	Do this instead
Calling the number in the email	Use the number in your system of record
Treating an inbound call as confirmation	Only outbound calls count
Confirming with whoever answers	Confirm with the person responsible for the change
Assuming the step was done	Log and audit every callback

Finance team checklist

Two-person approval for any vendor master-data change.
Mandatory callback to the number already on file.
Extra review on the first payment to a new account.
Red flags: urgency, secrecy, new country or bank, account name not matching the vendor.
Check the payee name your bank shows. In the euro area, Verification of Payee has been mandatory since October 9, 2025 and is free.
Forward instead of hitting reply, typing the address manually (FBI).
MFA on every mailbox, plus SPF, DKIM and DMARC.

Why are businesses hit harder?

Companies pay large invoices routinely, so one fraudulent payment blends in. UK Finance notes that 68% (£28 million) of invoice and mandate losses in 2025 came from business accounts for exactly that reason, even as overall cases fell to their lowest level on record (UK Finance). Train both the people who pay invoices and those who talk to suppliers, using real examples, and make the callback a logged, auditable step rather than a habit. J.P. Morgan stresses that missing a single step can lead to significant losses, so check that every callback used a trusted number.

What if the money already left?

Call your bank immediately and report at ic3.gov. In 2024 the IC3 Recovery Asset Team handled 3,020 cases and helped freeze $469.1 million in domestic transfers, a 66% success rate (IC3). Also warn the real vendor: their email may be compromised.

Finally, review every vendor whose bank details changed in recent months; if any change skipped the callback, verify it now with the number on file.

More on BEC, real estate wire fraud and the radar.