"We've changed our bank account": the invoice scam that costs businesses the most

The most expensive scam has no link

When we talk about phishing, we think of links and fake websites. But the scam that costs businesses the most money worldwide often has neither a link nor a dangerous attachment. It has a believable email and a new account number.

It's called Business Email Compromise (BEC). In practice it looks like this:

In English: "Hello, please note that because we have changed banks, our invoices are to be paid into the new account below, starting with the attached invoice no. 2026/418. Please confirm receipt. Thank you for your cooperation."

Why it's so convincing

• It comes from a real supplier, sometimes from their real address. Scammers often break into the supplier's mailbox first and read the correspondence for weeks.
• The invoice is correct: the number, the amount, the products. It's the invoice you were expecting.
• There's nothing "technical" to catch. No email filter knows that your supplier's IBAN was different last month.
• Sometimes the address is almost the same: kompania-sh.al instead of kompania.al, or rn instead of m.

Warning signs

1. Any change to a supplier's bank details, however routine it looks.
2. Urgency or secrecy: "pay it today", "don't call our accountant, she's on holiday".
3. A different bank or country, especially when the supplier is local.
4. Small changes in the address or signature, or replies coming from a different address than the one you've been talking to.
5. A request from "the director" for an urgent payment that skips the usual procedure.

The procedure that stops it

You don't need expensive technology. You need one rule, applied every time, without exceptions:

Back it up with these steps:

• Two people for payments above a threshold (e.g. above 200,000 lek): one prepares it, the other approves it.
• A list of suppliers with verified IBANs. Any change to the list needs phone confirmation and sign-off from a second person.
• No exceptions for "emergencies". Urgency is the scammer's main tool.
• Two-factor authentication on company email, so scammers can't get into your mailbox and send the same scam to your customers.
• Protect your domain with SPF, DKIM and DMARC, so no one can send email in your name. Check your domain for free.

If you've paid

Time is everything. Banks can sometimes stop a transfer if they're told within hours.

1. Call your bank immediately and ask them to stop or recall the transfer. Ask them to contact the receiving bank.
2. Report it to the police with all the emails (with full headers), the invoices and the transfer details.
3. Call your supplier. If their email has been compromised, other customers may be at risk too.
4. Check your own mailbox for forwarding rules you didn't create. It's the usual way scammers hide inside a mailbox.
5. Report the incident. Albania's Law no. 25/2024 "On cyber security" lets any organisation voluntarily report incidents to the National CSIRT at the National Authority for Cyber Security. For operators of critical and important information infrastructure, reporting is mandatory.

Your team is the last line of defence

The procedure only works if the people who make payments recognise the scam. Accounts, finance and executive assistants are the main targets. With Baitwise, they can experience this scenario in a safe simulation before they meet it with real money. Book a demo.