Your supplier's new bank details: call before you pay

The email looks like every other one from your casting house. Same logo, same signature, same person you’ve dealt with for six years. The bank changed, it says, so please send this month’s $18,000 to the new account on the attached form. There’s a voided check. Your bookkeeper updates the vendor record and the wire goes out Thursday.

Two weeks later the real supplier calls to ask where the payment is.

That is business email compromise, and the FBI counts it as one of the most expensive crimes reported to it. In 2025 the bureau’s Internet Crime Complaint Center logged 24,768 complaints and $3,046,598,558 in reported losses from it — up from 21,442 complaints the year before.

The fakes are getting harder to spot

Last week Payments Dive reported on a survey by Certos, the fraud-prevention unit of bank-owned Early Warning Services, of 230 senior finance leaders. 81% said their company had seen an attempted fraud that involved, or appeared to involve, AI in the past year, and when asked their biggest worry in their own words, 43% named payment diversion — money sent to the wrong account on a request that looked right. 84% said AI-enabled fraud is harder to detect than the old kind.

Those are finance leaders at Fortune 500 companies, venture-backed firms and nonprofits, with finance departments behind them. A jewelry store or a furniture showroom gets the same email — and often one person reads it, approves it and sends the money.

The FBI’s report says the same thing from the other side: chat tools can quickly write an official-sounding email, and voice cloning can make the follow-up phone call. In 2025, businesses reported more than $30 million in losses to these scams where AI was involved.

If the check depends on noticing that something looks off, it will fail on the one that doesn’t.

Why the phone call works when your eyes don’t

Every tip about bad grammar and odd sender addresses assumes the fake is sloppy — and more of them aren’t. The check that still works ignores the email entirely. The FBI’s guidance is plain: when you verify a request by phone, use previously known numbers, not the numbers provided in the e-mail request.

Nacha, the body that runs the rules for ACH payments, goes a step further. Its response plan for these scams warns that caller ID can be spoofed to show your vendor’s name. So if a change request arrives by phone, you hang up and call back on the number you already had.

What to do before the next one lands

1. 01Write the rule down. Any change to where you send a supplier’s money gets confirmed by a call to a number from your own records — an old invoice, the contract, your phone. Never the number in the email.
2. 02Put two people on it. The person who changes a vendor’s bank details shouldn’t be the person who releases the payment. In a small store that can be you and your bookkeeper.
3. 03Treat urgency as the warning. “Before end of day” and “keep this between us” are how these requests are built. A real supplier can wait an hour for a callback.
4. 04Ask a specific question on the call. Have them read you the old account’s last four digits. A person who works there can answer it. Someone who only took over the email account can’t.

The same trick works in reverse

This doesn’t only happen when you pay someone. A customer paying a large invoice, a wholesale account or a hotel group booking can get a fake email that says it came from you, with your bank details swapped out. Tell regular payers once, in writing, that your account details won’t change by email, and that they should call your main line if they ever get one that says otherwise.

Pull up the vendor list in your books this week and check that every supplier you pay by wire or ACH has a phone number on file that didn’t come from an email.