Our bank details have changed: the invoice-fraud email that costs small businesses most, and the call that stops it

The email is polite and short. A supplier you pay every month says their bank details have changed, the invoice is attached, payment is due today. It comes from their name, often from their real address, sometimes in the same thread as last month's invoice. You pay it. The supplier never sees the money, and in most cases neither do you. In 2025 people and businesses reported $3.05 billion lost this way to the FBI, more than to any other fraud except investment scams.

The short answer: no change of bank details is real until you've confirmed it by phone, on a number you already had before the email arrived. That one rule stops all three common forms of this scam, including the one where the email really does come from the supplier's own mailbox and every technical check passes. And if the money has already gone, the first hour matters more than anything after it: your bank's fraud line, then ic3.gov.

The numbers: what business email compromise costs

The FBI calls it business email compromise (BEC): someone gets into or imitates an email account and talks a business or person into sending money. The Internet Crime Complaint Center (IC3) publishes the reported losses every spring. Three years of them:

Loss per complaint is our division of the two FBI columns. For scale, the average loss across all 1,008,597 complaints in 2025 was $20,699, so a BEC complaint costs about six times the average. BEC was 2.5% of the complaints and 14.6% of the $20.877 billion lost. From October 2013 to December 2023 the FBI counted 305,033 BEC incidents worldwide and $55.5 billion in exposed losses.

These are only what people reported. On the business side, the Association for Financial Professionals' 2026 survey found 74% of organizations had BEC attempts or losses in 2025, up from 63% the year before; 85% received spoofed emails, and more than half got mail from domains that looked almost identical to real ones.

The three forms, and what each one wants

Fortra, an email security company, sorts thousands of BEC attempts every quarter by how the attacker asked to be paid. For October to December 2025, published by the Anti-Phishing Working Group:

So gift card requests are the most common attempt, but wires are where the money is: a $50,000 ask is the average, and the FBI's 2025 losses are mostly wires and ACH. Fortra put the jump in wire attempts (up 136% on the previous quarter) down to one gang it calls Scripted Sparrow, which sends up to six million emails a month to accounts payable teams: invoices for "executive coaching", just under $50,000, with a faked reply chain showing a company executive approving it.

The email itself

From:     Harbour Roasters Accounts <accounts@harbour-roasters.example>
Reply-To: harbour.remit@outlook.example
Subject:  RE: Invoice 4471 - updated remittance details

Hi Sam,

Please note our bank details have changed following our annual
audit. Kindly use the account below for invoice 4471 ($18,400.00)
and all future payments. The old account is no longer active and
payments to it will be returned.

Bank:      First Coastal Bank
Account:   ****0917
Routing:   ****4412

As the invoice is now overdue, we would appreciate payment today.
We are unable to take calls this week due to the audit, so email
is best.

Kind regards,
Dana
Accounts Receivable, Harbour Roasters

• "Following our annual audit": a reason, any reason. Real suppliers who change banks usually tell you weeks ahead, on letterhead, and often by post.
• "All future payments": they want the account set up in your system, not one payment.
• "Payments to it will be returned": pre-empts the obvious move of paying the old account.
• "Overdue", "today": urgency so nobody stops to check. The FBI's own advice on BEC is to slow down exactly when you're being hurried.
• "Unable to take calls": the one line that should end the conversation. The call is the check, so the email tries to remove it.

What the headers show, and what they can't

In Gmail, open the message, press ⋮ then Show original; in Outlook, File → Properties (desktop) or ⋯ → View → View message source (web). Paste the headers into our header reader and it says which checks passed and, more importantly, for whose domain. Here's what each form tends to look like:

A. A lookalike domain. The attacker registered harbour-roasters.example (with a hyphen) to imitate harbourroasters.example, and set up mail properly on it:

From: Harbour Roasters Accounts <accounts@harbour-roasters.example>
Reply-To: harbour.remit@outlook.example
Authentication-Results: mx.google.com;
       dkim=pass header.i=@harbour-roasters.example;
       spf=pass smtp.mailfrom=harbour-roasters.example;
       dmarc=pass (p=NONE) header.from=harbour-roasters.example

Everything passes, for the wrong domain. The tell is the domain itself, and a Reply-To that sends your answer somewhere else again. Gmail usually shows no banner for this one: it's a properly configured domain sending its own mail.

B. A free webmail address with the right display name. The most common form: Fortra counted 69% of BEC attempts in Q4 2025 sent from free webmail.

From: "Dana Whitfield" <dana.whitfield.office@gmail.com>
Reply-To: d.whitfield.ceo@outlook.example
Authentication-Results: mx.google.com;
       dkim=pass header.i=@gmail.com;
       spf=pass smtp.mailfrom=gmail.com;
       dmarc=pass (p=NONE) header.from=gmail.com

Passes again, for gmail.com. On a phone, many mail apps show only "Dana Whitfield", so the address is one tap away. The boss-and-gift-cards email nearly always looks like this.

C. The supplier's real mailbox, taken over. Someone phished Dana's password, read her mail for a few weeks, and replies in the real thread from the real account:

From: Dana Ruiz <dana@harbourroasters.example>
Authentication-Results: mx.google.com;
       dkim=pass header.i=@harbourroasters.example;
       spf=pass smtp.mailfrom=harbourroasters.example;
       dmarc=pass (p=REJECT) header.from=harbourroasters.example

Everything passes for the right domain, with a strict DMARC policy. There's often no Reply-To trick either: the attacker just adds a hidden rule in Dana's mailbox that moves your replies out of her sight. Nothing in the headers is wrong, because nothing about the sending is fake. Only the request is.

That last column is the point. Headers help you catch A and B early; only an outside channel catches C. Our earlier piece on Gmail's warning banners covers the yellow "Be careful with this message" banner, which you'll see on some form-B emails and on spoofs of domains with no DMARC record.

The phone-back rule

1. Take the number from your own records: the contract, an invoice from before the request, the supplier file in your accounting software, your own phone's contacts, or their website typed in by hand.
2. Never use a number from the email, its signature, an attached letter, or a "new direct line". If the mailbox is hacked, the attacker wrote those.
3. Ask an open question, then read back the last four digits of the new account. "Did you change banks?" before "Is it ending 0917?"
4. Write down who you spoke to, when, and what they confirmed.
5. A second person approves the first payment to any new or changed account.

"Hi, it's Sam at Fernhill Candles. We got an email asking us to pay
invoice 4471 to a new account. Before we do anything: did Harbour
Roasters change banks? The email gives an account ending 0917."

  Yes  -> "Thanks. Can you send me the change on your letterhead
           too? We'll pay the next invoice after it's in." (Then a
           second person approves the first payment.)
  No   -> "Then someone is using your name. You may want to check
           your mailbox; the email came from <address>. We won't
           pay to it." (Report it: see below.)

What it costs: a call like that takes about four minutes. A business that handles two bank-detail changes a month spends 24 × 4 = 96 minutes a year on it. The loss per BEC complaint in 2025 was $123,005. Even a small supplier invoice, say $18,400, is several years of a bookkeeper's phone time.

Two follow-ups make it stick. Put the rule in writing (below), so whoever sits at the payables desk on a busy Friday doesn't have to decide alone. And tell your own customers the same thing: our article on the invoice email that gets paid says the same from the sender's side: never change bank details by email alone, and say so in the invoice.

Changes to how we pay anyone (supplier, contractor, employee)

1. A change of bank details is never accepted by email alone,
   including from an address we know.
2. We confirm it by phone, on a number taken from our own records
   before the request arrived (contract, an older invoice, the
   supplier file). Never a number in the request.
3. The person who confirmed it writes down who they spoke to, when,
   and the last four digits they read back.
4. A second person approves the first payment to the new account.
5. Anyone who asks for gift cards, crypto or secrecy by email or text
   gets a call on their usual number, even if it's the owner.
6. Nobody is ever in trouble for slowing a payment down to check.

If it's the boss asking for gift cards

No business pays a client or a vendor in Apple or Google Play gift cards. Treat any request for gift cards, crypto or "keep this between us" as fake until you've reached the person on their usual number. If the cards are already bought and the codes sent, the FTC's advice is to contact the card's company at once, whatever time has passed, and keep the cards and receipts; if money is still on a card, some issuers can freeze it.

Then report it at ReportFraud.ftc.gov and ic3.gov.

The first hour after paying

The FBI's Recovery Asset Team runs what it calls the Financial Fraud Kill Chain: it contacts the bank that received the money and asks it to freeze the account. It works only while the money is still sitting there. Its 2025 results:

International losses are the total minus the domestic figure. More than half the money in those cases was stopped, which is far better than most people expect, and it only happens when someone acts quickly. In order:

One hard fact about business accounts: the US consumer protections for unauthorized transfers (Regulation E) cover personal accounts only. Business wires fall under Article 4A of the Uniform Commercial Code, and when you or your staff sent the payment yourselves, even after being tricked, courts generally treat it as authorized. The bank followed your instructions. The call before paying is cheaper than any argument after.

The short version

• A change of bank details is confirmed by phone, on a number you had before the email. Every time.
• The email may come from the real supplier's real address with SPF, DKIM and DMARC passing. Headers catch lookalike domains and free webmail; they can't catch a hacked mailbox.
• "Can't take calls this week" is the warning sign, not an obstacle.
• Gift cards are never a business payment method.
• Already paid? Bank fraud line in the first ten minutes, ic3.gov with full transaction details right after.
• Write the rule down and have a second person approve the first payment to a new account.

Got a suspicious one in front of you? Paste its headers into the free header reader: it shows in plain words which domain actually sent it and whether the Reply-To goes somewhere else. Nothing is stored.

Sources

• FBI IC3, 2025 Internet Crime Report: 1,008,597 complaints, $20.877 billion; BEC 24,768 complaints and $3,046,598,558 (three-year tables); Financial Fraud Kill Chain 3,900 incidents, $1,163,919,846, $679,013,183 frozen, 58%
• FBI IC3, 2024 Internet Crime Report: BEC $2,770,151,146 (2024), $2,946,830,270 (2023)
• FBI IC3, Domestic Financial Fraud Kill Chain brochure: 2025 incidents 3,574, losses $832,965,941, frozen $507,042,623, 61%; guidance for victims (recall, hold harmless letter, detailed complaint)
• FBI IC3, International Kill Chain process (FinCEN Rapid Response Team)
• FBI IC3 public service announcement, Business Email Compromise: The $55 Billion Scam (11 September 2024): 305,033 incidents, $55,499,915,582, October 2013 to December 2023
• APWG Phishing Activity Trends Report, Q4 2025 (BEC section by Fortra): cash-out methods, $50,297 average wire request, +136% wire attempts, Scripted Sparrow, 69% free webmail
• Nacha on the AFP 2026 Payments Fraud and Control Survey (13 May 2026): 74% of organizations had BEC in 2025, 63% in 2024; 85% spoofed emails; lookalike domains
• FTC, Avoiding and reporting gift card scams: gift card companies to contact
• Spencer Fane, Fraudulent wire transfers: who bears the loss (UCC Article 4A, commercial accounts)
• Virginia Lawyers Weekly, Wire fraud litigation: the loss allocation rules for Article 4A (20 April 2026)
• Gmail Help: trace an email with its full headers (Show original)

The names, addresses and account numbers in the examples are made up; .example domains can't be registered. This article is general information, not legal advice. The FBI, FTC, APWG, Fortra, AFP, Gmail and the card companies are named for their public reports and help pages; email59 is not affiliated with any of them.