The New Bank Details Email: A Playbook for Finance Teams

Somewhere in your accounts-payable inbox right now there is an email that will cost more than any malware your endpoint stack blocked this year. It carries no attachment and no link. It says, politely: "Please note our updated bank details for the attached invoice."

The economics explain the volume. In the APWG Phishing Activity Trends Report for Q2 2026, the average amount requested in a wire-transfer BEC attack jumped 45% in a single quarter, from $42,663 to $61,732 — while the number of those attacks rose 88%. The FBI's long-run tally puts combined exposed losses from business email compromise at $55 billion over a decade, with more than $3 billion in reported U.S. losses in 2025 alone. Almost all of it moves through one mechanism: somebody changed a bank account field, and nobody picked up the phone.

We've written before about defending against BEC as a whole. This playbook zooms in on the single moment where the money is actually won or lost — the payment-change request — and on the three teams that receive it: accounts payable, procurement, and payroll.

Three doors into the same vault

Payment-diversion fraud wears three main disguises. The pretext differs; the mechanism — redirect a legitimate payment to an attacker's account — is identical.

Variant	Who gets the email	The pretext	The tell
Invoice fraud	Accounts payable	A fake invoice, or a real one with "updated" bank details	New account, new urgency, sender resists callbacks
Vendor email compromise	AP / procurement	A genuine supplier thread, hijacked after a mailbox takeover	The only new thing in a familiar thread is the account number
Payroll diversion	HR / payroll	An "employee" switching banks before the next pay run	Webmail or lookalike sender; small amounts that dodge thresholds

The second variant is the one that defeats trained eyes. In vendor email compromise the attacker has taken over the supplier's real mailbox, read months of correspondence, and replies inside the genuine invoice thread — a form of conversation hijacking where the sender, the amount, the reference numbers, and the timing are all authentic. No amount of "check the sender address" training catches it, because the sender address is right.

Anatomy of a nine-figure payment change

The ceiling on this fraud is set by process, not by cleverness. Between 2013 and 2015, a Lithuanian man named Evaldas Rimasauskas invoiced Google and Facebook for hardware that a real supplier, Quanta Computer, never shipped — and the two most technically sophisticated companies on earth paid him more than $120 million before anyone called the vendor. In 2019, a European subsidiary of Toyota Boshoku wired roughly $37 million after attackers posing as a business partner changed the payment destination. Neither attack touched a server. Both walked through the accounts-payable door.

The fraud does not happen when the money moves. It happens weeks earlier, in the quiet minute when someone updates a bank-account field without picking up the phone.

What the cases share is instructive. The requests arrived at plausible moments, matched expected purchases, and came from identities the recipients had reason to trust. The attackers' real skill was not technical — APWG notes that prolific BEC crews like Scripted Sparrow operate on spoofed reply chains and fabricated invoices, not exploits. The defense, therefore, is not a filter. It is a process that assumes any payment instruction can be false, however authentic the thread it arrives in.

The payment-change playbook

Every control below is procedural, cheap, and survives the attacker having full control of the counterparty's mailbox. That last property is the test that most "check carefully" advice fails.

1. Callback on every bank-detail change — to a number you already had. Verify every new payee and every change to an existing payee's account by calling a contact at the supplier on a number from your vendor master file or a signed contract. Never use a number from the email, the invoice, or the change form: the attacker supplied all three. Log who verified, with whom, and when.

2. Dual approval, separated duties. The person who edits vendor bank details must not be the person who releases payments. A second approver re-checks the verification log, not the invoice. This single separation would have stopped most of the nine-figure cases cold.

3. Hold the first payment to any changed account. A 48–72 hour cooling period gives the real supplier time to chase a missing payment while the funds are still freezable. Flag first payments to new accounts for manual review regardless of amount — payroll diversion deliberately rides below approval thresholds.

4. Match three ways. Invoice against purchase order against goods or services received. Mass-mailed fake invoices for domain renewals and directory listings die at this step without anyone needing to spot a forgery.

5. Move changes out of email entirely. Where volume justifies it, require bank-detail changes through a supplier portal with its own authentication, and tell vendors — in the contract — that emailed change requests will never be actioned. The same applies internally: payroll changes go through the authenticated HR self-service portal, not an inbox.

6. Watch for lookalike infrastructure. Monitor registrations of lookalike domains for your top suppliers and your own brand. APWG's Q2 2026 data shows BEC crews overwhelmingly register their domains at a handful of cheap registrars days before the attack; a new domain one character off a key vendor's is a signal worth an alert.

7. Verify the voice, too. A phone call is only out-of-band if you placed it. Inbound calls "confirming" a change count for nothing — and with deepfake voice attacks on finance teams now documented at eight-figure scale, a familiar-sounding voice on a call you did not initiate verifies nothing either.

8. Train the teams that move money — and measure them. AP, procurement, treasury, and payroll staff face a different attack than the rest of the company, so generic phishing tests under-train them. Run role-based simulations built on payment-change pretexts — the updated-details email, the hijacked thread, the executive exception request — and track verification behavior over time as part of a human risk score for the finance function. The metric that matters is not who clicked; it is who called back.

When the money has already moved

Speed beats everything else in recovery. The FBI's Recovery Asset Team runs a Financial Fraud Kill Chain with U.S. partner banks: in 2025 it acted on 3,574 domestic incidents and froze about $507 million — a 61% recovery rate in the cases it reached. But mule networks layer and disperse funds within days, so the rate decays by the hour.

The sequence: call the sending bank's fraud desk immediately and request a recall; file a complaint with IC3 the same day so the kill chain can trigger; preserve the emails and headers; and treat the incident as a live intrusion, not a closed loss — check the mailboxes on both sides for hidden forwarding rules, because the attacker who redirected one payment is usually still reading. Our incident response guide for social engineering covers the containment steps in detail.

Payment-diversion fraud is the purest expression of human risk: no exploit, no payload, just a well-timed request to the one person who can move money. Which means it is also among the most fixable. A callback rule, two signatures, and a 72-hour hold cost nearly nothing — and they would have saved companies like the ones above a combined nine figures.