The Fake Invoice & "New Bank Details" Scam
Last verified: October 2026
A vendor emails new bank details. A boss asks for a quick wire. The money goes to a crook, not to them. One simple call-back rule stops this scam cold — here's how it works. Want a hand setting it up? My number is (330) 200-8042.
The Scam, and the Rule That Beats It
The costliest scam hitting small businesses isn't fancy hacking — it's a convincing email, called business email compromise, that talks someone into sending money to the wrong account. A vendor 'changes banks,' a 'boss' needs an urgent wire, an invoice looks just like the usual ones. There's no malware to scan for, so the only reliable defense is a habit: before you change any payment details or send any new wire, verify the request by calling a phone number you already had on file — never the number in the message — and have a second person sign off. There's a printable 29-page version up top, and if money's already gone, report it fast at ic3.gov.
Common Questions
1 Why can't I just reply to the email to confirm the new details?
Because if the email came from a crook, your reply goes right back to them — and they'll happily confirm the fake details. The call-back rule verifies through a different channel, using a phone number from your own records, not from the message.
2 It really looks like my vendor's real address. Isn't that safe?
Not necessarily. Crooks sometimes break into a real mailbox and send from the genuine address, mid-thread. That's exactly the case the call-back is built for — a phone call to a known number catches it when the email itself can't be trusted.
3 What is business email compromise (BEC)?
It's when a crook poses as a vendor, boss, or employee and sends a fake invoice or 'new bank details' to redirect a payment into their account. No malware is involved — it's a trust-and-process failure, and a call-back rule is the fix.
4 What dollar amount should trigger a second approver?
Whatever would genuinely hurt to lose — a judgment call for your business. Pick a number low enough to catch the payments a crook would target but high enough not to slow daily work. And any bank-detail change should be verified at any amount.
5 We already got tricked. Can we get the money back?
Sometimes, if you move fast. Call your bank immediately to try to recall or freeze the transfer, and report to the FBI at ic3.gov right away — recovery works best in the first hours. Keep every email and record, and don't be embarrassed.
6 Isn't this just common sense? Do I need a written rule?
The written rule is what holds up on a busy, stressful day when a request feels urgent and official. Common sense bends under pressure; a rule everyone knows and follows doesn't. That's the value of writing it down and posting it.
Would You Rather I Just Help?
This scam is exactly the kind of thing I love to help stop before it ever costs you — it's cheap to prevent and brutal to clean up. I'll help you write the call-back rule, build your trusted-contacts list, turn on email MFA, and walk your team through it. $99 flat for a visit, 30-day come-back-free. No jargon, no judgment.
Would you rather I just do this for you?
No shame in it — plenty of folks would rather hand it off, and that's what I'm here for. I'll come to your home, set it up right, and make sure it's working before I leave. Flat $99 per visit — no jargon, no upsell, and every visit is 30-day come-back-free.
Not a hardware job? I can often fix it remotely for $49 — a secure screen-share, up to 2 hours, that you watch the whole time and can end whenever (included free for $39/mo Support Plan members, and it counts toward the $99 if it turns out I need to come out).