How payment redirection fraud works
The scam is simple. A criminal gets into a supplier's mailbox, or registers a domain that looks almost the same, and reads the email history. When an invoice is due, they send a polite message: the business has moved banks, please use the new account from now on. Sometimes they attach a letter on letterhead or a bank confirmation that looks official.
Because the message usually arrives in the middle of a real conversation, with the right names, invoice numbers and amounts, nothing seems out of place. The office updates the payee details, pays the next invoice, and only finds out weeks later when the real supplier chases the unpaid bill. By then the money has usually been moved through several accounts. The same trick is used in reverse. Your customers may receive a fake message that looks like it came from you, asking them to pay a new account. That is one reason to secure your own mailboxes as carefully as you check other people's messages.
The verification steps, in order
First, don't reply to the email to ask whether it's genuine. If the mailbox is compromised, the scammer will happily confirm. Second, find a phone number for the supplier from somewhere independent: your accounts system, a previous invoice from months ago, their website typed in by hand, or a business card. Never use a number from the message asking for the change.
Third, call and ask to speak to someone you know or to their accounts team. Explain you've received a request to change bank details and ask them to read out the new account number. If they know nothing about it, you've stopped a fraud and should tell them their email may be compromised. Fourth, record the check: who you spoke to, when, and what they confirmed.
Make a second person part of the change
In a small office the same person often receives invoices, updates supplier details and makes payments. That concentration is exactly what scammers exploit. Split the job if you can: one person verifies and enters the change, another approves it in the banking system before it's used. Most NZ business banking platforms support dual authorisation for new payees or for payments above a threshold.
If you only have one person in accounts, the owner or manager can be the second approver for bank changes only, which takes a minute a month. It also helps to send a small test payment to the new account and have the supplier confirm the exact amount received before you send a large one.
Pressure tactics to watch for
Requests to change bank details often come with a reason that sounds plausible: an audit, a merger, a problem with the old bank, or a temporary account while the main one is frozen. They may also ask you to keep it quiet or to pay urgently to avoid late fees. None of these are reasons to skip a phone call.
Watch for the timing too. Changes requested just before a large payment, at the end of the month, or late on a Friday afternoon are higher risk, because people are rushing and the supplier is harder to reach. If the person you call is unavailable, wait. A genuine supplier would rather be paid a day late than paid into the wrong account.
Protecting your own customers from the same scam
Tell your customers, in writing and more than once, that your bank account will not change by email, and that any change will be confirmed by phone. Add a line to your invoice footer saying so. Customers who know your rule are much more likely to question a fake message that claims to be from you.
On the technical side, set up SPF, DKIM and DMARC for your domain so it is harder for anyone to send email that pretends to be from your exact address, and turn on multi-factor sign-in for every mailbox. Watch for lookalike domains registered with a letter swapped or a different ending, and tell customers if you spot one.
Keep a trusted record of supplier bank details
Most payment redirection losses happen because the accounts system is the only place the bank number is stored, and anyone who can edit it can change it. Keep a short, separate record of each regular supplier's confirmed account, with the date it was verified and who checked it. When an invoice arrives, compare the account on it with that record rather than with whatever is already loaded in the system.
Review the list once or twice a year and remove suppliers you no longer use. Limit who can edit payee details in your accounting software and banking, and turn on any change notifications they offer, so an unexpected edit gets noticed by someone other than the person who made it.
In short
- Never update a supplier's bank account from an email alone.
- Call a number you already had, not one in the message.
- Use dual approval for new payees and changed accounts.
- A test payment confirmed by the supplier adds a cheap extra check.
- Tell your own customers your bank details won't change by email.