Business email compromise: how ‘new bank details’ scams work

Business email compromise (BEC) targets the moment money moves. A criminal either gains access to a real mailbox — yours or a supplier’s — or registers a look-alike domain. They then send a convincing email asking for a payment to new bank details.

Because the email often sits inside a genuine conversation, or comes from a real account, it can look completely legitimate.

• A request to change bank details, especially by email alone.
• Urgency or secrecy: ‘please process today, keep this between us’.
• A sender address that’s almost — but not exactly — right.
• Small changes in tone, signature or formatting.
• A senior person asking for an unusual payment while ‘unavailable’.

1. Never accept bank-detail changes by email alone.
2. Verify any change by calling a phone number you already have on file — not one in the email.
3. Require a second person to approve new or changed payees.
4. Turn on multi-factor authentication for every mailbox.
5. Regularly check mailboxes for forwarding rules nobody created.

Call your bank immediately and ask them to contact the receiving bank to recall the payment. Preserve the emails as original files, not forwards. Then establish how it happened: was your mailbox compromised, the supplier’s, or neither? That answer matters for insurance, liability and making sure it doesn’t happen again.