“Please note our new bank details”
A real supplier, a real invoice, and one line changed: the account number. The most expensive scam in Europe, and the quietest.
RECONSTRUCTION - NAMES, NUMBERS AND DOMAINS ARE INVENTED. THE PATTERN IS REAL.
Nothing in this message is fake except the account number. The supplier is real, the invoice number is real, the amount is real, and often the email thread itself is real, because the attacker has been reading the supplier's mailbox for weeks and simply replies inside an existing conversation at the moment an invoice falls due.
It works because it asks for no click and no password. It asks a busy person to do their normal job, once, with one field different. By the time the real supplier chases the unpaid invoice a month later, the money has been through three accounts and left the EU.
- 01A change of bank details announced by email, however polite and however plausible the reason. Bank migration, audit, new accounting system: the story varies, the ask never does.
- 02The new account is in a different country from the supplier, or at a neobank when they have always used a high-street bank.
- 03The reply comes inside a genuine thread but from a lookalike domain: one letter swapped, a hyphen added, .com instead of .se. Read the address, not the name.
- 04Timing on a due date, with a soft deadline and a mild apology. Pressure that feels reasonable is still pressure.
- 05The sender asks you to update details for all future invoices. One payment is a theft; a standing change is a pipeline.
- 01Call the supplier on a number you already had on file, never a number in the email, and ask one question: did you change your bank?
- 02If the payment already went out, call your bank in minutes, not hours. Ask for a recall on the transfer and give them the beneficiary IBAN. Recovery odds fall by the hour.
- 03Tell the supplier their mailbox is probably compromised. Until they reset it, every invoice they send is suspect.
- 04Put the rule in writing for the whole finance team: bank changes are confirmed by phone, on a known number, every time, no exceptions for urgency or seniority.
Reading about it is not the same as catching it live. See whether this one would get past you.