The “New Bank Details” Scam: How Fake Vendor Emails Steal Small Business Payments

It usually starts with an email that looks completely routine. A vendor you've paid for years writes: "Quick heads-up, we've moved to a new bank. Please send this month's payment to the account below." The logo is right, the invoice number is right, even the amount is right.

It's a scam, and it's one of the most expensive ones small businesses face. Here's how it works, the red flags to watch for, and the one habit that stops it cold.

How the scam works

Criminals either break into a vendor's real email account or set up a lookalike address. Then they wait. When a real invoice is due, they send a polite note asking you to update the bank details. You pay the invoice like you always do, but the money goes to an account the scammer controls. By the time the real vendor calls asking why you haven't paid, the money has usually been moved.

The FBI calls this business email compromise. In its 2025 Internet Crime Report, it was the second-costliest type of cybercrime in the country, with about $3 billion in reported losses out of nearly $21 billion overall. Small offices are a favorite target because one person often handles the bills, and nobody double-checks a change that looks normal.

The red flags

1. Any request to change where you send money. New bank, new account number, "please use ACH instead of a check this time." Treat every payment change as suspicious until you've verified it, even from someone you know.

2. A lookalike email address. One letter off (abcsupply.com becomes abcsuppIy.com, with a capital I instead of an l), a different ending (.co instead of .com), or a reply-to address that doesn't match the sender. On a phone screen, you'll almost never notice.

3. A real email thread that suddenly changes course. If the vendor's own mailbox was hacked, the message can come from their real address, in the middle of a real conversation. That's why checking the address alone isn't enough.

4. Urgency and a reason not to call. "We need this today or the account goes on hold." "I'm traveling, email is the best way to reach me." Pressure plus a reason to skip the phone call is the classic combination.

5. Small changes to a familiar invoice. A slightly different PDF layout, a new "remit to" line, or a bank in a state where the vendor has no presence.

How to protect your business

• Call to confirm, using a number you already have. Before changing any payment details, call the vendor at the number in your records or on their official website, never the number in the email.

• Use a two-person rule for payment changes. One person requests the change, a second person verifies it by phone. It takes five minutes and stops this scam almost every time.

• Turn on two-step sign-in for every email account. It's the single best way to keep your own mailbox from being the one that gets hijacked and used against your customers.

• Watch for hidden mail rules. Attackers who get into a mailbox often create rules that forward or hide messages from the bank or vendor. Your IT provider should be checking for these.

• Train whoever pays the bills. Share this post with them. The person clicking "send payment" is your last line of defense.

If you already sent the money

Speed matters more than anything. Call your bank immediately and ask them to recall the wire or ACH payment. Then file a report at ic3.gov, the FBI's Internet Crime Complaint Center. The sooner the banks are involved, the better the odds of freezing the money before it disappears.

The bigger lesson

Like the "big order" scam, this one doesn't need a virus. It works on busy people and trusted routines. The fix is a simple rule everyone on your team follows: verify through a channel you already trust before you pay, ship or change anything.

Not sure your team would catch it?

Smartkinect offers a free IT security check-up for small businesses in Arlington Heights and the Northwest Suburbs. We'll check your email security, two-step sign-in and mailbox rules, plus your backups and Wi-Fi, and give you a plain-English list of what to fix first.

Call (847) 242-1160 or contact us to schedule yours.

Want a quick read on where you stand first? Take our free 3-minute IT Security Scorecard and get a letter grade for your business.