Fake bank details emails: how to stop payment fraud

"Please note our bank details have changed." It's one of the most expensive sentences in business. Criminals use fake or hijacked emails to persuade people to send money to the wrong account – and once it's gone, it's very hard to get back. The good news: a few simple checks stop almost all of it.

How big is the problem?

According to UK Finance, criminals stole £1.28 billion through payment fraud in 2025. Authorised push payment (APP) fraud – where someone is tricked into sending money themselves – accounted for £576.4 million, up 19% on the year before. Business victims lost £75.6 million to APP fraud alone.

How the scam works

The details vary, but the pattern is almost always the same:

1. The criminal gets into, or imitates, an email conversation. Sometimes they've broken into a real mailbox – a supplier's, a client's or yours. Sometimes they use a lookalike address that's one letter off.
2. They wait for the right moment – an invoice due, a house purchase about to complete, a deposit to pay.
3. They send new bank details, often with a believable reason ("we've changed banks", "our usual account is being audited") and some urgency.
4. The money goes to an account they control and is moved on within minutes.

Property transactions are a favourite target because the sums are large and the timing is predictable – which is why solicitors and estate agents now warn clients about it at every stage.

Warning signs

• Any request to change bank details by email – treat it as suspicious until proven otherwise.
• Urgency or secrecy: "pay today", "don't call, I'm in meetings".
• A sender address that's slightly different from usual, or a "reply-to" that goes somewhere else.
• Changes in tone, spelling or signature compared with previous emails.
• Your bank's Confirmation of Payee check saying the name doesn't match the account.

The simple checks that stop it

1. Always call to confirm new bank details – on a number you already have, never one from the email.
2. Use two-person approval for new payees and large payments, so one rushed person can't be caught out alone.
3. Never ignore a Confirmation of Payee mismatch. Stop and check.
4. Tell your clients up front that you will never change your bank details by email – and repeat it on invoices and in email signatures.
5. Slow down. Genuine suppliers and clients won't mind a quick phone call.

Technical protection that helps

Process stops the payment; technology makes it far harder for criminals to get into the conversation in the first place:

• Multi-factor authentication on every mailbox, so stolen passwords aren't enough.
• Email authentication (SPF, DKIM and DMARC) to stop criminals sending email that pretends to come from your domain.
• External sender warnings that flag emails from outside your business.
• Alerts for suspicious mailbox rules – a classic sign that someone is quietly watching an inbox.

If it happens to you

Speed matters more than anything. Call your bank immediately – or dial 159 – and ask them to contact the receiving bank. Then report it to Report Fraud (England, Wales and Northern Ireland) or Police Scotland, and get your IT provider to check whether a mailbox has been compromised.

We help businesses – including many solicitors and estate agents – put both the checks and the technical protection in place. If you'd like a second pair of eyes on yours, get in touch.