Company paid the wrong supplier account

What happened when the invoice was paid

An email arrived that looked like it came from a regular supplier, referencing a real invoice number and a real amount already expected. It asked for payment to a “new” bank account, explained as a change in the supplier’s banking arrangements.

Someone in finance or admin processed the payment as part of a normal work day, following the usual steps for an invoice that looked routine.

Days later, the actual supplier followed up asking why the invoice was still unpaid, and the mismatch became clear.

Why the changed bank details were not questioned

The email was not an obvious fake. It matched the supplier’s writing style, used a real invoice reference, and may have come from a domain that looked almost identical to the genuine one.

Behind it, a scammer had likely read a real email thread, either by compromising the supplier’s inbox or spoofing an address close enough to pass a quick glance. Payments due on a deadline get processed under time pressure, which is exactly when a changed detail is easiest to miss.

This is business email compromise, a pattern that targets ordinary payment processes rather than any one person’s mistake.

The one call that would have caught it

A phone call to the supplier, made using a number already on file rather than one in the email, would have confirmed the account change in minutes. This single check is what most versions of this scam rely on victims skipping.

It matters who makes the call and how. Calling a number from the same email that requested the change confirms nothing, since the scammer controls that line too.

Going forward, any change to bank details should trigger this call before a payment is released, regardless of how urgent the email sounds.

What your business can still do

Contact your bank immediately and ask about a recall or a hold on the receiving account. Read how a bank recall works so your finance team knows what information the bank will ask for.

Report the matter to the police so the Commercial Crime Investigation Department (CCID) can open a case, and call the National Scam Response Centre on 997 if the payment was recent. Preserve the original email with its full headers, the invoice, and any related correspondence. Read the first actions to take after a scam like this if you are unsure of the order to follow.

If the amount is significant, whether pursuing a civil claim is worth it is worth an honest first assessment once the immediate reporting is done.

Setting up the control for next time

A simple rule prevents most repeats: any change to a supplier’s bank account must be confirmed by phone, on a number the business already holds, before the next payment goes out. This single step protects the whole payment process.

It also helps to separate who requests a payment from who approves it, so a single compromised email cannot move money on its own. The recovery routes available after an incident like this depend heavily on how quickly the business acted, so treat this as the reason to fix the process now.

The person who processed the payment followed a process that looked normal. The fix belongs in the process, not in assigning blame.