Verdict · At work · Reviewed October 2026 · 3 sources
A vendor emailed us new bank details
Don't pay the new account until a phone call confirms the change. Call the vendor on a number you already had before this email, and hold the payment until someone you know there says yes.
The next two minutes
Hold the payment. Don't reply to the email, and don't use any phone number or link in it.
Call the vendor on a number from your own records: an earlier invoice, your contacts, or their website typed in yourself.
Ask someone you know there to confirm the change. If they didn't send it, tell them their email may be compromised.
Already paid the new account? Call your bank now and ask them to recall the transfer, then report it at ic3.gov.
Who to tell
- Your bank
Right away if money went out. Ask for a recall of the transfer and what else they can do.
- ic3.gov
The FBI asks businesses to report every case, whatever the amount, with the transfer details.
- The vendor
On the number you already had. Someone may be inside their email, and their other customers are next.
Say this
“If a vendor emails new bank details, we call them on the number we already have before we pay.”
One line to repeat, so the whole household (or team) answers the same way.
The step that stops the next one
Make sure it can't happen again
Your free Clear Path puts your business's security in order, one small step at a time. No account needed.
Start our path from hereWhy this works
The figures behind the verdict, each with a dated source.
Business email compromise, where a criminal poses as a vendor or a colleague to redirect a payment, cost $3.05 billion across 24,768 complaints to the FBI in 2025, second only to investment fraud.1 Businesses also reported more than $30 million in these losses where AI was involved, a floor because only complaints that mention AI are counted.1
Fraudsters mostly impersonate vendors or executives to change payment instructions. In a 2026 survey of treasury professionals, calling an authorized contact on a number from your own records was the control most often rated very effective against it.2
The FBI's advice is to verify any change to account information through a second channel. If money has gone, contact your bank immediately to request a recall, and file at ic3.gov regardless of the amount.3
Speed matters. In 2025 the FBI's Recovery Asset Team froze $679 million of the $1.16 billion in attempted theft it worked on, which is why the call to your bank comes first.1
Why the rule holds: you never have to judge whether the email is real. A real change survives a phone call to a number you already had, and a fake one doesn't.
By the numbers
$3.05 billion1
Reported business email compromise losses in 2025, from 24,768 complaints.
FBI Internet Crime Complaint Center (IC3), 2025 IC3 Annual Report, pp. 7-8 (complaints and losses by crime type)
$679 million1
Frozen by the FBI's Recovery Asset Team in 2025, out of $1.16 billion in attempted theft it worked on.
FBI Internet Crime Complaint Center (IC3), 2025 IC3 Annual Report, p. 17 (Recovery Asset Team)
Common questions
The email came from the vendor's real address. Isn't that enough?
No. If a criminal is inside the vendor's mailbox, the email really does come from their address, sometimes as a reply in a thread you already have. That's why the check is a phone call on a number you had before, not a look at the email.
Won't calling every time annoy our vendors?
Most vendors are glad you checked, because the fraud hurts them too. Tell them once that you confirm every bank-detail change by phone, and the call becomes routine.
Keep going
- ThreatHomeBusiness
AI-powered phishing and business email compromise
Criminals now use AI to write fluent, personalized phishing emails and payment requests, in any language and at volume. Business email compromise (BEC), where a scammer poses as a boss, vendor or title company to redirect a payment, drew $3.05 billion in reported losses to the FBI in 2025. Typos are no longer the tell; a request to move money or change bank details is. Confirm every one on a second channel you already trust.
Read - GuideBusiness
Two-channel verification for payments
Money only moves after a second channel confirms it. Keep a list of known-good phone numbers, call back on those numbers before paying or changing bank details, require two people above a set amount, and know who to call in the first hour if money goes out. Among the controls finance teams use against business email compromise, that callback is the one most often rated very effective.
Read - GuideBusiness
A one-page AI use rule for your team
Your team is probably using AI already, so the useful question is which tools, with what data, and who checks the result. This guide helps you write those answers on one page, get everyone to sign it, and review it twice a year. When you need more, our full AI Acceptable Use Policy generator uses the same structure and is free with a free account.
Read
Sources
Every figure on this page links to where it came from. We favor government, standards, and methodology-backed sources, and we take no money from anyone we cite.
- 12025 IC3 Annual Report (Internet Crime Report) · FBI Internet Crime Complaint Center (IC3) · April 2026Government · accessed October 23, 2026
- 22026 AFP Payments Fraud and Control Survey Report: Key Highlights · Association for Financial Professionals (AFP), underwritten by Truist · April 2026Research · accessed October 23, 2026
- 3Business Email Compromise: The $55 Billion Scam (I-091124-PSA) · FBI Internet Crime Complaint Center (IC3) · September 11, 2024Government · accessed October 23, 2026