The Vendor Billing Diversion

Flggd Scam School · Subscription & Invoice Fraud · Lesson 6 of 10

An email from a supplier says their banking details have changed and future payments should go to a new account. A vendor changed bank details email is one of the most expensive scams a business can fall for; here's how to catch it.

The message looks like this

Why this is a scam

The email isn't from your vendor. Either their mailbox was hacked or the sender's address is one letter off from the real one. The invoice number can even be real, lifted from a stolen email thread.

Nothing else changes; the goods keep arriving and the invoices keep coming. Only the destination of your money moves, and by the time the real vendor asks where their payment is, it's gone.

The "confidential" line is the tell. It exists to stop the one thing that kills this scam: a quick phone call to the vendor.

Red flags checklist

• Any request to change payment details, arriving by email.

• Urgency plus secrecy: "effective immediately", "treat as confidential".

• The sender's domain is slightly different from the vendor's usual one.

• The tone or sign-off doesn't match your usual contact.

• The new account is with an unfamiliar bank, or in another country.

The manipulation tactic

Borrowed trust. The scam hides inside a relationship you already rely on, so the request inherits years of legitimacy it never earned.

What to do, and what not to do

• Call your vendor on the number you already have on file; never the one in the email.

• Verify every bank-detail change by voice with a known contact, every time. No exceptions.

• Don't reply to the email or use its links or attachments.

• Set a company rule: no payment-detail changes without callback verification.

• If money already went out, call your bank immediately; fast action sometimes recovers it.

Not sure about a message you've received? Check it in seconds with the free Flggd app.