"We have a new bank account number": how to handle a supplier changing their IBAN

An email from a familiar supplier with a new bank account number sounds harmless — but this is one of the most common ways SMBs lose thousands of euros. Here's how to handle it properly.

You receive a perfectly professional email from a supplier you've been doing business with for years. "Dear customer, with immediate effect we have a new bank account number. Please update your records accordingly." There's a signature at the bottom — maybe even a logo. Everything looks normal.

And yet this is exactly the scenario that has cost many SMBs thousands — sometimes tens of thousands — of euros in recent years. Not through hackers breaking into your computer, but through a single email that arrives at just the right moment. In the industry this is known as CEO fraud, invoice fraud, or Business Email Compromise. In plain language: someone impersonates your supplier and tricks you into transferring money to their account.

Why this trick works so well

Fraudsters know exactly what they're doing. They send these emails at moments when they seem plausible: around the turn of the year, after a holiday period, or just after you've genuinely received a quote or invoice from that supplier. Sometimes they've hacked your supplier's mailbox and have been quietly reading along for a while. They know exactly when an invoice is on its way, and send a "correction" with the new account number at precisely that moment.

Other times it's simpler: they create an email address that looks like your supplier's (for example @compny.com instead of @company.com), or they put something recognisable in the "from" display name while the actual address is something entirely different.

The simple routine that saves you a lot of headaches

You don't need to be an IT expert to protect yourself against this. Agree on one simple internal rule: never accept a change of bank account number based solely on an email. Full stop. Even if it appears to come from your regular contact. Even if the logo looks right. Even if it says "urgent" — especially then.

What actually works:

1. Call the supplier back. Not on the number in the email, but on the number you already know — from your records, their website, or an old invoice. Simply ask: "Is it correct that you have a new bank account number?" The answer is usually: no.
2. Verify the IBAN yourself. A valid IBAN has a fixed structure and a check digit. Fraudsters sometimes use numbers that look correct but aren't. Our IBAN checker shows you in seconds whether a number is technically valid and which bank it belongs to.
3. Check whose name the account is registered to. When making a transfer, your bank now shows the name linked to an account number (the IBAN name check). If you see something unexpected — for example a personal name instead of a company name — stop immediately.
4. Look at the actual email address. Not just the display name you see in your inbox, but the full address. Click on the sender and watch for unusual characters, extra letters, or a different domain from the one you'd expect.

Write it down in a short procedure

If more than one person in your organisation handles payments — the bookkeeper, an assistant, someone in the office who occasionally steps in — it's worth writing this down once. Not as a thick policy document, just a single sheet with four lines:

• New bank account numbers are never processed based solely on an email.
• We always call back on a known number to confirm.
• For amounts above X euros, a second person always co-signs.
• If in doubt: don't pay, discuss it first.

That last rule is perhaps the most important. Fraudsters rely on time pressure and on the feeling that you don't want to keep someone waiting. Paying a day later is almost never a problem. Transferring money to the wrong account is — in practice, you rarely get it back.

What if it's already gone wrong?

If you realise within a few hours that an incorrect payment has been made, call your bank immediately. If the fraudster hasn't yet moved the money on, the bank can sometimes reverse the payment. Also always report it to the police and notify the Fraud Helpdesk. Make sure to inform your actual supplier too: there's a good chance their mailbox has been hacked and that other customers have received the same email.

What about your own email?

Of course, the reverse can happen to you too: someone impersonates your business and defrauds your customers. You can largely prevent this with proper email security (SPF, DKIM and DMARC). It's a one-time setup, and it makes it significantly harder for fraudsters to send emails on behalf of your domain.

In short: never accept a new bank account number based solely on an email. A phone call takes thirty seconds. Not sure about an IBAN? Run it through our IBAN checker before you transfer anything.