Supplier Changed Bank Details by Email? Stop and Verify

October 18, 2026

A new bank account in a supplier's email is one of the most common ways trade payments are stolen. How the scam works, the warning signs, and what to do.

Short answer: if a supplier emails you new bank details, do not pay until you have confirmed the change by phone or video call, on a number you already had. In many cases the email really does come from the supplier's own address, because the supplier's mailbox has been hacked.

How the scam works

Someone gets into a mailbox. Usually the seller's, sometimes the buyer's, through a fake login page or a stolen password.
They read quietly and wait. Nothing happens until an invoice or a payment is due.
They send "updated" bank details. The reason sounds routine: the usual account is "being audited", "under tax inspection" or "closed for maintenance". The email comes from the real address, or from a look-alike address with one letter changed.
The money moves on fast. The receiving account belongs to a middleman, and the funds are usually transferred out within hours or days.

How big the problem is

The FBI calls business email compromise "the $55 billion scam": that is the exposed loss it counted worldwide from October 2013 to December 2023. In 2024 alone, the FBI's Internet Crime Complaint Center received 21,442 complaints of this kind, with reported losses of $2,770,151,146.

What courts and regulators have decided

Belgium, 2021. A company received an email, apparently from its supplier, asking it to pay a different, foreign account. The supplier's email had been hacked. The company questioned the change internally, but paid anyway. The Enterprise Court of Brussels (27 October 2021) held that it could not rely on the fraudulent email and still had to pay the supplier, plus interest and damages. An earlier Antwerp Court of Appeal decision (5 September 2019) reached the same result even though the email came from the seller's usual address.
United Kingdom. A company director paid £12,000 after a second email, sent from the supplier's real but hacked mailbox, said the usual account was "being audited". The Financial Ombudsman found that the bank's scam warning did not explain how this kind of scam works, and told the bank to refund him in full.

The lesson: whether you get your money back depends on your country, your bank and the facts. In many places, paying the wrong account does not cancel what you owe your real supplier.

Warning signs

The new account is in a different country from the supplier.
The account name is not exactly the seller named on your contract.
The email pushes for speed: "pay today or production stops".
A routine-sounding reason: audit, tax inspection, bank maintenance.
The email address, or the reply-to address, differs by a letter or a domain.
You are asked to keep the change confidential, or to split the payment.

How to protect your payments

Put the seller's bank details in the signed contract, and agree that they can only change with a signed amendment.
Never accept a change by email alone. Call or video-call a person you already know, on a number you already had.
Check that the account name matches the seller on your contract, character by character.
A small test payment proves only that the account exists, not who owns it.
Turn on two-step login for your own email accounts.

For the full 10-point checklist, see How to buy steel from China without getting scammed.

If you have already paid

Call your bank at once. Ask it to recall the payment and to contact the receiving bank. Hours matter: in 2024 the FBI's Recovery Asset Team attempted to freeze funds in 3,020 cases and reported a 66% success rate.
Report it to the police. In the United States, also file at ic3.gov.
Keep the evidence: the emails with full headers, the invoices and the payment records.
Tell your real supplier through a channel you trust, and change the passwords on your own email.
Ask a lawyer where you stand under your contract. This page is general information, not legal advice.

How it works when your contract is with SinoAli

Your contract names the SinoAli company bank account, and SinoAli will never ask you to pay a personal account. If you receive a message asking you to change the bank account, do not pay. Verify it with your SinoAli account manager by phone or video call first.

Read how payment works

Questions buyers ask

The email came from my supplier's real address. Is it safe? No. In the cases above the email came from the real address, because the mailbox had been hacked. Confirm by phone or video call on a number you already had.

Can I get my money back? Sometimes, if you act within hours or days. Once the money has been moved out of the receiving account, recovery is rare.

Will I still owe my supplier? Often, yes. In the Belgian cases the buyer had to pay again. It depends on your contract and your country.

Does a small test payment prove the account is genuine? No. It proves the account exists, not who owns it.