Bank Detail Change Email Fraud: Why "Our Account Has Changed" Emails Pass Your Filter — and How to Stop Them

Bank detail change email fraud is when an attacker impersonates your supplier, claims "our bank account has changed" and diverts your next payment to the fraudster. Because the email comes from a lookalike domain the attacker controls, it passes SPF, DKIM and DMARC. To stop it, verify every bank change by phone and use an email platform that flags lookalike domains.

Key takeaways

• A bank detail change email comes from the attacker's own lookalike domain, so it passes SPF, DKIM and DMARC and slips past the spam filter.
• According to the FBI IC3 2025 report, reported business email compromise (BEC) losses in the US reached $3.05 billion in 2025.
• The most effective control is process: confirm every bank change by calling a number you already hold, and require two-person approval.
• If money has gone, minutes count; the FBI IC3 Recovery Asset Team froze 58% of the targeted transfer value in 2025.
• On the technical side you need an email platform that flags lookalike domains, mismatched reply addresses and changed payment details together.

What a bank detail change email looks like on the finance desk

Your accounts team receives dozens of supplier emails a day, and one of them reads: "Our bank account has changed; please make this month's payment to the new account details attached." The display name, signature and invoice number are all familiar, and the message often appears to continue a real thread. In the month-end rush the payment run is prepared, the new IBAN goes into the supplier record and the money leaves. The mistake typically surfaces weeks later, when the real supplier calls to ask why they have not been paid.

This is payment diversion fraud (known in the UK as mandate fraud), a form of Business Email Compromise (BEC). What sets a bank detail change email apart from ordinary phishing emails is that it usually carries no malicious link or attachment and is written in completely routine business language. That lets it slip past the filter and a careful employee at the same time. When the attacker impersonates your own executive instead of a supplier, the same pattern becomes CEO fraud.

How much does bank detail change fraud cost businesses?

As of 2026 there is no regular public statistic on losses from bank detail change and other BEC fraud in Türkiye; the most detailed data comes from the United States, and the picture is clear:

According to the FBI's Internet Crime Complaint Center (IC3), 24,768 business email compromise complaints in the US reported total losses of $3.05 billion in 2025. (FBI IC3 2025 Internet Crime Report)

The sums requested in BEC attacks are growing too. According to the APWG Phishing Activity Trends Report for Q2 2026, the average amount requested in wire-transfer BEC attacks rose to $61,732, up 45% on the previous quarter. For a small or mid-sized business, one successful email can knock a month's cash flow off course.

The data also shows why email filters miss payment diversion attacks. According to the Verizon 2026 Data Breach Investigations Report, 80% of attacks blocked by email security gateways were plain phishing, while only 3% were BEC-style emails trying to get the victim to update a bank account ahead of a wire transfer. Gateways mostly catch the crude attacks; the quiet, targeted ones are a small slice of what they stop.

Once money has gone, hours matter. The FBI IC3 2025 report says its Recovery Asset Team initiated 3,900 incidents in 2025 involving $1.16 billion in attempted theft and froze $679 million of it (a 58% success rate), stressing that "time is of the essence" once a fraudulent transfer is discovered. Acting fast depends on everyone knowing, in advance, whom to call and how.

How is a bank detail change attack built, step by step?

In bank detail change fraud the attacker does not need to break into your systems. The usual sequence is:

1. Pick the counterparty. Your website, reference lists, LinkedIn or previously leaked correspondence reveal which suppliers you work with.
2. Register a lookalike domain. example-logistics.com becomes example-logistlcs.com (an l for an i), or an address using international characters that looks identical.
3. Configure authentication properly. It is the attacker's own domain, so SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail) and DMARC (Domain-based Message Authentication, Reporting and Conformance) are set up perfectly.
4. Time it. Month end, the invoicing period, or the week the real supplier sends a genuine invoice.
5. Send the request. Short and urgent — "our bank details have changed", "our account is frozen, please pay into this one" — or a copy of the genuine invoice PDF with the IBAN swapped.

In some cases the attacker takes over the supplier's real mailbox, so the email comes from exactly the right address. The compromised-mailbox scenario shows why technical checks alone are never enough and process controls are essential. The freight-payment version of this scenario is covered in logistics email fraud. The risk multiplies at accounting firms that take payment instructions on behalf of clients; their specific controls are in accounting firm document management.

Why does a bank detail change email get past the spam filter?

Spam filters essentially ask two questions: does the sender prove who they are? and does the content look like known spam? With a bank detail change email, both answers reassure the filter.

The problem is not a bad filter; it is a filter looking in the wrong place. Catching a bank detail change email means adding three questions to "is this email technically valid?": does the sender's domain imitate a known counterparty, are replies being redirected elsewhere, and does the message talk about a change in payment details?

We cover the domain tricks in our guide to lookalike domain attacks. Checking whether the invoice itself is fake (tax number, e-invoice lookup, duplicate invoices) is a separate control and the subject of fake invoice email scams.

How to prevent bank detail change fraud: an eight-step framework

1. Never confirm a bank change by email. Call the supplier on the number held in your own records — not the one in the email.
2. Require two people for any change. The person who enters the new IBAN in the supplier record and the person who approves it should be different; no payment to new details should rest on one person's decision.
3. Watch the first payment. After the first transfer to new details, get the supplier to confirm receipt. Matching bank transactions to supplier accounts every day also surfaces an unexpected outflow early; see bank reconciliation automation.
4. Move your own domain's DMARC to p=reject. This setting makes it harder to send fake mail as you; on its own it does not stop lookalike domains. To get there without blocking legitimate senders, first learn how to read DMARC reports.
5. Flag lookalike domains and Reply-To mismatches. Addresses one character away from your suppliers' domains should raise a separate warning. Treat this as a separate criterion when you choose a business email service.
6. Log who does what on shared mailboxes. You should know who opened a request in accounts@ and how they replied.
7. Put sensitive outgoing mail through approval. A payment confirmation or a reply containing bank details should not leave on one person's initiative; our email approval workflow guide shows how to set this up.
8. Write down the incident playbook. Who calls the bank, how correspondence is preserved, and how a notification under KVKK (Türkiye's Personal Data Protection Law, the local counterpart of GDPR) is assessed if personal data is involved should all be decided in advance. Under Board Decision 2019/10, a data controller must notify the Board within 72 hours at the latest of becoming aware of a breach (KVKK 2025 Annual Report); for details, see the KVKK 72-hour breach rule.

How to verify a bank detail change: the callback protocol

Phone verification of a bank detail change only works if its rules are written down. Keep these five on the finance team's desk:

1. Never take the number from the email. Use the number already held in the supplier record, the contract or the supplier's official website.
2. Speak to someone you know. Talk to the supplier's finance or sales contact you already deal with, not the person who sent the request.
3. Let them supply the details. Instead of "Have your bank details changed?", ask "Can you tell me the new bank and the last four digits of the account?" A yes/no question is easy to game.
4. Record the check. Note in the supplier record who confirmed it, when and on which number.
5. No confirmation, no payment. If the contact cannot be reached, the payment is held and the request escalated; "urgent" does not bend this rule.

How Digital Bridge reduces payment diversion risk

At Digital Bridge we tackle bank detail change fraud by working on process and infrastructure together, not just by installing software:

• We map where you stand. As part of our cyber security consultancy we review your domain's SPF, DKIM and DMARC records, the permission structure of your shared mailboxes and the approval steps in your payment process.
• We put the payment process in writing. With your finance and procurement teams we define which channel verifies a bank change, who approves it and what happens if something goes wrong. Where needed, we design a two-person approval flow for supplier record changes in your ERP system or in custom web software.
• We cover the data protection side. If a successful attack could expose correspondence containing personal data, our data protection compliance work prepares your breach notification and record-keeping procedures.
• We train with realistic scenarios. Phishing and BEC awareness sessions use examples modelled on your own supplier names, and we review the basic controls beyond email with you using our SME cyber security checklist.

How SmartMail flags a bank detail change email

SmartMail, the business email product in Digital Bridge's Smart360 family, asks the questions a spam filter skips (lookalike domain, redirected replies, changed payment details) on every incoming message. Each email goes through three groups of checks: identity (SPF, DKIM, DMARC and PTR, which SmartMail computes itself), structure (lookalike and international-character domains, display-name and brand impersonation, Reply-To and link mismatches) and content (the full text assessed with AI). Signs of changed bank or payment details are weighed together with these checks.

The result SmartMail produces is not just a score but a report with written reasoning, so the person in accounts sees something concrete — "the domain imitates a known contact and the reply address differs" — before a payment is made. The company administrator sets the quarantine threshold, and before a new threshold is saved SmartMail lists the messages it would affect. Authentication and domain checks run in software and keep working even when the AI allowance is used up.

SmartMail's second layer is send approval: a payment confirmation leaving on the organisation's behalf can be put to one or more approvers first — approve, request a revision with a reason, or reject, each step time-stamped. On shared mailboxes access is split into nine separate permissions; deletion and quarantine management are off by default for new assignments, and every message carries its own action history. Attachment analysis pulls the parties, due date, grand total, document number and tax number out of an invoice PDF without downloading the file, which makes it easy to compare against the supplier record.

Next step: measure your own exposure

The first step to seeing your own bank detail change risk is simple: list the bank change requests your accounts mailbox received in the last three months and how each was verified. Then get in touch: we will review your domain records with you and demonstrate SmartMail's security analysis and approval flow in an environment set up with your own addresses. If you would rather start using SmartMail straight away, compare the plans at SmartMail.com.tr and buy it through Smart360. For the other forms of email fraud, see our Business Email & Documents guide.