How the scam works
What happens
Criminals compromise or imitate a supplier or executive email account and send changed banking details or urgent payment instructions. The message can appear inside a genuine email thread.
Example scenario
A familiar supplier email thread suddenly includes new banking details for an overdue invoice.Example wording is illustrative and may differ from real scam messages.
Warning signs
Red flags to look for
01
Unexpected bank-detail change
02
Urgent executive payment instruction
03
Slightly altered email domain
04
Request to bypass normal approval procedures
Safer response
What to do next
01
Verify bank-detail changes by calling a known number
02
Use multi-person payment approval
03
Inspect the full sender address
04
Immediately contact banks if payment was made