You get an email from a supplier you’ve paid before. The invoice looks right. The amount is right. But there’s a new line: “Please use our updated bank details.” Do you pay it?
Not until you’ve made one phone call. That’s the short answer. The rest of this post is why, and how to do it properly.
What happened in Iowa
A recent news story out of the US shows how this goes wrong. According to a report on an advisory from Iowa’s State Auditor, a city clerk received an email asking for electronic payment for a public works project. The invoice looked legitimate. It matched the amount the city expected to pay.
The city only found out something was wrong when the real contractor asked to be paid. The email could end up costing the city $655,000. A separate $211,000 payment sent to the same fraudulent account was recovered by the city’s financial institution. The city has also filed an insurance claim, notified law enforcement and is adding safeguards. The auditor’s office didn’t name the city.
That’s a government, not a small business. But the trick is the same one that hits a three-person landscaping company or a bookkeeper’s client. Nobody hacked a bank. Someone sent an email, and a person did what the email asked.
The auditor also said this was the second fake-email scam reported to his office in less than a month. He mentioned that he had been a target himself. In 2022, someone emailed the state’s HR department asking to deposit his paycheque into a different account. An employee phoned him directly before making the change, and that call caught it.
Why a “perfect” invoice is the dangerous one
Most of us expect a scam to look sloppy. This one didn’t. The amount matched what the city expected. That detail matters. If a scammer knows what you’re about to pay, whether from a compromised mailbox or from public information, the invoice doesn’t need to be clever. It only needs to arrive at the right moment.
The source doesn’t say how the scammer got the amount, so I won’t guess. What I can say is that you can’t judge these by how professional they look. You judge them by whether the payment details were confirmed through a channel the scammer doesn’t control.
How to tell if this could affect you
If you pay suppliers, contractors, or subcontractors by e-transfer, EFT, or wire based on an emailed invoice, you’re exposed. So is anyone who runs payroll by email request. The risk goes up if one person both receives invoices and approves payment, and nobody else ever looks.
Ask yourself three questions:
- If a supplier’s email asked me to change their bank account, who would notice?
- Do I have a phone number for each regular supplier that didn’t come from an email?
- Would I find out within a day if a payment went to the wrong place, or only when the real supplier chased me?
If the answers are “nobody,” “not really,” and “when they chased me,” that’s the gap.
What to do today
These steps follow the advice in the Iowa advisory, plus some standard practice I’d give anyone.
- Call to verify every bank detail change. The advisory says to call the vendor using a phone number you already have on file. Not the number in the email. Not a number in the invoice’s footer if the invoice is the thing you’re checking. An old invoice, a signed contract, or your own records are better sources.
- Don’t reply to the suspicious email to ask if it’s real. The advisory warns that replying could put you back in touch with the scammer. If the scammer controls that address, they’ll happily say yes.
- Make a second person approve changes. Even in a small business, the person who updates the bank details shouldn’t be the only one who sees the request. A quick “did you check this?” from a partner, office manager or bookkeeper is enough to break the spell.
- Send payment notices to established email addresses. The advisory recommends this. Send the “we’ve paid you” message to the address you’ve always used, and ask the supplier to confirm receipt promptly and report any payment that doesn’t arrive. If the money went to a scammer, the real supplier will tell you quickly instead of weeks later.
- Write the rule down. “No bank detail changes without a call-back” should be a sentence in your process, not a habit one person has. It also protects staff. It’s much easier to say “our rule is we always call” than to question a message that appears to come from a client or the boss.
Email signs a SOC analyst looks at
The advisory tells employees to examine email addresses and website links closely, watch for unusual wording or grammatical errors, and avoid clicking links or downloading attachments from unknown senders. Here’s how that works in practice. This is general analyst practice, not something from the Iowa case.
- The sender’s actual address, not the display name. Many mail apps show only “Dana at Supplier Co.” Click or tap the name to see the real address. Look-alike domains swap a letter, add a word, or change the ending.
- A different reply-to address. The email can appear to come from one address while replies go somewhere else. If you hit reply and the address changes, stop.
- Links that don’t match the text. Hover over a link before you click. If it doesn’t go where it claims, don’t use it.
- Unusual tone or timing. Pressure to pay today, a sudden change in how the supplier writes, or a request to keep the change quiet are all reasons to pause.
- A change that arrives with an invoice. Legitimate banking changes are rare. When one comes bundled with a payment request, it deserves extra scrutiny.
- A new attachment or “secure document” link. If it’s unexpected, confirm by phone before opening it.
None of these alone proves fraud, and a clean email proves nothing either. The Iowa invoice looked fine. That’s why the call-back matters more than the email inspection.
Signs something already went wrong
- A supplier says they haven’t been paid for an invoice you know you paid.
- You paid to account details that differ from what you used before, and you can’t point to a phone call confirming them.
- A supplier says they never sent the updated details.
- Your own contacts get odd emails from your address, or you find mail rules you didn’t create, which can mean someone has access to your mailbox. Check your mailbox rules and reset your password if you see anything strange.
If money has already gone out
Move fast and call your bank or financial institution first. In the Iowa case, the city’s institution recovered a $211,000 payment sent to the same fraudulent account. I wouldn’t promise that outcome to anyone, but it shows why raising the alarm quickly is worth it.
Then follow the same steps the city took. Notify law enforcement, which in the Iowa advisory means local police and the FBI. In Canada, that means your local police, and you can also report to the Canadian Anti-Fraud Centre. Check whether your business insurance covers fraud losses, and ask about the claim process. The city filed an insurance claim hoping to recover more.
Tell the real supplier right away, too. Their email may be compromised, or someone may be impersonating them to others. They’ll want to know.
When to get help
If you suspect someone has access to your email account, or you can’t tell how the scammer knew your invoice amount, a managed IT or security provider can review your sign-in logs and mailbox rules. If you’re not sure whether money has left your account, your bank is the first call. Do that before anything else.
