Skip to main content

What to do now

Fake invoice or changed bank details: what to do before you pay

Last checked

An email says a supplier changed banks, or an invoice looks right but pays a different account. The message can come from the supplier’s real mailbox, hacked, so it can look perfect. The check is a phone call.

Do this now

  1. Don’t pay, and don’t reply to the email

    A reply goes to whoever controls the mailbox.

  2. Call the supplier on a number you already had

    Use the number from your contract, an earlier invoice or your records, never one from the email or the new invoice, and speak to the person you usually deal with.

  3. Already paid? Call your bank now

    Ask it to recall the transfer, and stop any pending payment to the new details. Speed matters: the money is moved on quickly.

  4. Warn the supplier

    Their mailbox may be the one that was hacked: they need to secure it and warn their other customers.

  5. Check your own mailbox

    Look for forwarding rules and filters you did not create, change the password and turn on two-step verification.

  6. Keep everything

    Keep the emails, the invoices, the bank statements and the transfer orders: your bank and the police will ask for them.

  7. Report it and file a complaint

    File a report with the services below as soon as possible, even if the bank recovered the money.
On this page08

Check it with isMalicious

isMalicious compares what you paste with the threat intelligence sources it collects. It does not scan your device and cannot undo what already happened.

Email checker

Paste the sender’s address into the email checker to see whether threat sources report it.

What it does not mean
No listing proves nothing: a hacked real mailbox is on no list.

Domain reputation check

Paste the domain of the sender’s address into the domain reputation check: a lookalike of your supplier’s domain registered recently is a strong warning sign. Paste your supplier’s real domain to see the lookalikes isMalicious already lists.

What it does not mean
Not listed is not proof of safety: a lookalike registered for one attack is often on no list.

Report it

Keep the message, the link or the number until you have reported it: you will need them. These are the services that handle each case.

In the United States

In the United Kingdom

Somewhere else? Report to your national police or your country’s cybercrime reporting service.

In France? The French version of this guide lists the French services.

How to spot the next one

  • A change of bank details announced by email, especially with urgency or a request for discretion.
  • The sender’s address differs from the usual one by a letter, a word or an extension.
  • Pressure to pay today, or to skip your usual checks for once.

Questions

We paid the new details. Can the money come back?

Sometimes, if your bank acts before the money is moved on. Call it at once and ask for a recall. In the US, the FBI’s IC3 asks victims to file a complaint quickly: it may help freeze the funds.

The email came from our supplier’s real address. How?

Their mailbox may have been hacked: the message really came from their account, but not from them. That is why the check is a phone call to a number you already had, not a reply.

Can isMalicious check a bank account number?

No. It checks email addresses, domains, links, phone numbers, crypto wallets and file hashes against threat listings; a bank account number is not one of them.

Related guides

Further reading

Sources

The steps follow these official pages, read on :

Free account

Keep checking with a free account

Without an account, checks stop at 10 an hour. With a free account you skip that wait and can run up to 60 a minute, and you can save up to 10 reports every 30 days.

Create free account

No credit card required