Invoice fraud: fake supplier bank changes explained
By Trusterity · Updated 14 November 2026
An email from a real supplier — or what looks like one — says their bank account has changed. The next payment goes to criminals.
How it works
- Criminals register a look-alike domain, or take over the supplier's real mailbox.
- They time the request for just before a large, expected payment.
- They attach a convincing letter on copied letterhead.
Warning signs
- Any change of bank details requested by email.
- A sender domain that is almost, but not exactly, right.
- Pressure to update “before the next payment run”.
The control
Confirm every bank-detail change by phoning the supplier on the number already in your vendor master — never the one in the email — and require a second approver.
Check look-alike domains of your company
Test your team
8 requests, 5 minutes, free.
Now catch them in your inbox.
T-Frame is a free Chrome extension for Gmail, Outlook and WhatsApp Web. It shows the risk of each message and why, and warns you before you open a dangerous link.
Free. Install, sign up with your email, done.
Add T-Frame to Chrome — free
T-Frame works on your computer, in Chrome.