A supplier asks us to change their bank details. How do we check it is genuine?
Verify it through a channel the request did not come from. Call the supplier on a phone number you already have on file, from a contract or an earlier invoice, never one given in the new message, and confirm the change with someone you know there. Many companies also require a second approver in finance before the supplier's master data is changed, and they flag the first payment to the new account for an extra check. Be particularly careful when the request comes with urgency, a new contact person, a bank in another country, or an explanation such as an audit or a change of bank. This fraud works even when the e-mail really comes from the supplier's address, because their mailbox may have been taken over. Network monitoring cannot judge such a request; the call-back is the control that does.
Read next
Related questions
- We paid a fraudulent invoice. What should we do now?
- A supplier's e-mail account was hacked and they wrote to us. What should we do?
- Why can't a network security tool stop invoice fraud?
- Someone is sending fake invoices in our company's name. What can we do?
- How do we stop criminals sending e-mail that pretends to come from our domain?
← All 29 questions on Phishing and e-mail aftermathAll topics