"Our bank account number has changed": how to verify that email before you pay

An email saying "our bank account number has changed" is one of the most common fraud tactics targeting SMBs. Five simple checks and one clear team agreement will prevent almost all losses.

You're back from holiday, or just returning after a long weekend. You open your laptop and find a tidy email in your inbox from your "accountant" or "supplier": could you please update the bank account number for the latest invoice? The IBAN they give you is one you've never seen before. Is this legitimate? And how do you check without having to make a phone call in the middle of a busy workday?

Fraudulent bank account changes are a classic trap that SMBs fall into regularly. The losses often run into thousands of euros per incident. The good news: with a few simple agreements and a minute of extra effort, you can prevent almost all of this fraud.

Why bank account fraud works so well

Fraudsters count on three things:

• Time pressure. The email arrives on a Friday afternoon or just before a public holiday.
• Familiarity. The sender's name looks right, the signature looks right, sometimes even the formatting matches previous emails.
• Routine. Whoever updates an IBAN in the records usually does so without a second pair of eyes.

The email doesn't even need to come from a hacked account. It's often a look-alike domain or a simple spoof that nobody notices. The wording is usually polished: "due to a change at our bank" or "we recently moved to a new entity". Sounds plausible. It isn't.

The five checks you always run

1. Is the IBAN technically valid?

Every IBAN has a built-in checksum. A typo or a made-up number will fail it immediately. This is your very first filter: if a number isn't even valid, there's no need to make any calls.

Our IBAN check does this in two seconds. Paste the number in and you'll instantly see whether the format is correct and which bank it belongs to.

2. Does the bank match the supplier's country?

Your Dutch landscaping company suddenly asking you to transfer money to an account in Lithuania? Red flag. Not always fraud — some businesses do use foreign payment providers — but always worth a phone call.

Also check whether the bank's country matches what you already have on file. A switch from one Dutch bank to another is easy to explain. A switch to an online bank in Bulgaria rarely is.

3. Call back using the number you already have — not the one in the email

This is the most important rule, and the one most often skipped. Call the phone number you already have in your records, or the one listed on the supplier's official website. Not the number at the bottom of the email — that's exactly the number the fraudster will answer.

Ask directly: "I've just received an email saying your account number is changing to NL.. — is that correct?" Five sentences, done.

4. Cross-check with the Chamber of Commerce

For larger changes — a new entity, a new trading name, a switch to a foreign account — also verify the Chamber of Commerce registration number and company name. If a supplier is suddenly invoicing from a different legal entity "due to a reorganisation", you want to confirm that entity actually exists and that your contact is genuinely linked to it.

5. Two pairs of eyes when making any change

Agree as a team: any IBAN change in the accounts payable records must be confirmed by a second person before the first payment goes out. It takes thirty seconds and could save you a quarter's profit in the worst case.

A simple protocol that works

Print this — literally — on an A4 sheet and put it next to the desk of whoever handles the finances:

1. IBAN change received? Don't update it straight away.
2. Check the IBAN using the IBAN check.
3. Call the number already in our system.
4. Confirm verbally: which person, which new IBAN, from which date.
5. Have a second colleague review the change in the accounting system.
6. If possible, make the first payment a small test amount.

That last point is a handy trick for large transfers to a new IBAN: send €0.01 first with a clear payment reference, then ask the supplier to confirm by phone that they've received it. Only then send the full invoice amount.

What if something goes wrong anyway?

If you discover within a few hours that a payment has gone to a fraudulent IBAN, call your own bank immediately. If the funds haven't yet been withdrawn by the fraudster, the bank may in some cases be able to recall or freeze the payment. Every minute counts. Also file a report with the police and notify Fraudehelpdesk — this helps build a picture of the pattern.

And warn your supplier: there's a good chance their email environment, or yours, has been compromised, and other customers may be receiving the same email.

One small moment, one big difference

The thing about bank account fraud is that it requires no advanced technology whatsoever. It works because people are busy and systems have no built-in safety stop. That also means: with one simple team agreement and thirty seconds of extra effort, you'll catch it almost every time.

Want to run that first check in just two clicks? Bookmark our IBAN check in your browser alongside your other finance tabs. Not sure whether your entire purchasing and payment process is watertight? Take a look at our access check — we'll go through together who has access to which payments and which two-eyes checks make sense for your business.