Solo Exporter's Handbookby RelaySolo

Bank detail change fraud: how it works and how to stop it

Short answer

Fraudsters get into your mailbox or your buyer's, or copy your domain, and send a convincing request to pay a new account. Stop it with two-step sign-in, regular checks of mail forwarding rules, and one firm rule told to every buyer: bank details are never changed by email, and any change is confirmed by phone on a number you already have. If money has gone, call the paying bank at once and ask for a recall.

RelaySolo team · Published 12 Nov 2026 · Last checked 12 Nov 2026

For a solo exporter, the most expensive email you'll ever get may be one you never see: a message that looks like it came from you, telling your buyer to send the deposit or balance to a "new" account. Government cyber agencies in the US, UK and Australia describe the same pattern, and the FBI's Internet Crime Complaint Center (IC3) counts it as business email compromise (BEC). In its 2025 annual report, IC3 recorded 24,768 BEC complaints with reported losses of about US$3.05 billion. Those are only the cases reported to IC3.

This guide covers how it works, how to spot it, how to make your own business a hard target, and what to do if a payment has already gone to the wrong account.

How the fraud works

  1. They get a way into the conversation. Either they break into a real mailbox (yours or your buyer's), usually with a stolen password from a phishing page, or they register a lookalike domain. The Australian Cyber Security Centre describes lookalikes made by swapping letters or adding characters, for example replacing "l" or "o" with "1" or "0".
  2. They watch quietly. Inside a hacked mailbox they read your threads, so they know the order, the amount and when the balance is due. The UK's NCSC describes a real case where the attacker set up a mail rule that moved every email containing "payment", "invoice" or "bank details" into a folder nobody looked at.
  3. They send the change. A new invoice, or a short note: the bank account has changed, please use these details for this and future payments. It arrives in the same thread, with your signature, at a believable moment.
  4. The buyer pays. Often nobody notices until you ask why the balance hasn't arrived, and by then the money has usually moved on.

Both sides can be the entry point. If your mailbox was used, your buyer loses money and blames you. If your buyer's mailbox was used, they may send you a "new" delivery address or a request that looks like it came from their finance team. Either way, the fix is the same: never treat email alone as proof.

Warning signs

  • A change of bank account at all. The UK government's fraud campaign notes it's rare for businesses to change bank accounts.
  • A new account in a different country or a different name from the company's.
  • Urgency ("pay today to avoid delay") or secrecy ("don't discuss this with anyone else").
  • A sender address that's almost right: one letter changed, an extra word, a different ending.
  • A reply-to address that differs from the sender, or a phone number you've never seen before.
  • Small changes in tone or language from someone you've emailed for months.
  • Emails you expected that never arrived, or replies from the buyer about messages you didn't send.

Protect your own mailbox

As a one-person business, your mailbox is your whole sales department. The official advice comes down to a few steps:

  1. Turn on two-step sign-in (multi-factor authentication). The Australian Cyber Security Centre calls it one of the most effective controls against business email compromise. Do it for email first, then marketplaces and your bank.
  2. Check your forwarding rules and filters. The NCSC tells people with a possibly hacked account to check email filters and forwarding rules. Do it once a month anyway. Look for any rule you didn't create, especially one that forwards mail outside or moves messages about payments.
  3. Use a unique, long password for your email, and never sign in through a link in an email. That's how most passwords are stolen; see fake inquiries and phishing aimed at exporters.
  4. Consider registering obvious lookalikes of your own domain, as the ACSC suggests, so nobody else can.

Tell your buyers the rule in advance

The UK government's Stop! Think Fraud campaign advises suppliers to make sure their terms explain how they'll notify customers of any change to payment details. For a solo exporter, the simplest version is one fixed sentence that appears everywhere your bank details do: the proforma invoice, the commercial invoice, and your email signature.

Line for invoices and signatures
Our bank details will not change by email. If you ever receive a message asking you to pay a different account, do not pay. Call me on [your phone number] first.

Say it once more, in the email that goes with the first proforma invoice to a new buyer:

Note to a new buyer
Dear [name],

Attached is proforma invoice [number] for order [reference].

One security note: our bank account is the one on this invoice, and it will not change during our business together. Fraudsters sometimes send fake "new bank details" emails that look like they come from suppliers. If you ever receive one from us, please don't pay. Call me on [phone] or message me on [another channel you both already use] to check.

Best regards,
[name]

Write your bank details exactly once in your own records and copy from there, so a typo never makes a genuine invoice look suspicious. If you really do have to change accounts, tell the buyer by phone first and send the new details in a signed document; don't rely on email alone.

When a buyer, or "you", asks for a change

Every agency we checked gives the same rule: confirm by a different channel, using contact details you already had.

  • Call a phone number you already had on file. Don't use the number in the email asking for the change; Scamwatch is explicit about this.
  • Don't reply to the email to ask "is this real?". If the mailbox is compromised, the fraudster answers.
  • The UK campaign suggests confirming both the old and the new account details when you call.
  • If your buyer forwards you a "change" that you didn't send, treat your mailbox as compromised: change the password, turn on two-step sign-in, check forwarding rules, and warn your other buyers.

If money has gone to the wrong account

Speed matters more than anything. IC3 says "time is of the essence" and that its process for freezing funds works best when complaints are filed as quickly as possible.

  1. The payer calls their bank immediately and asks for a recall of the funds. Only the bank that sent the money can start this, so if your buyer paid, help them do it now, with the date, amount, receiving bank and account number.
  2. Report it to the police cyber or fraud reporting service in the payer's country, and in yours:
    • United States: IC3, regardless of the amount, with the full transaction details. IC3's Recovery Asset Team works with banks to try to freeze funds.
    • United Kingdom: Report Fraud, which replaced Action Fraud in December 2025 (phone 0300 123 2040), or Police Scotland in Scotland.
    • Australia: ReportCyber, run by the Australian Signals Directorate.
    • Elsewhere: your national police cybercrime unit or computer emergency response team (CERT).
  3. Secure the mailbox that was used: change the password, sign out all sessions, turn on two-step sign-in, remove unknown forwarding rules.
  4. Warn your other buyers that someone may contact them pretending to be you, and repeat your bank details by phone.
  5. Keep the evidence: the full emails with headers, the fake invoice, payment confirmations.

Who bears the loss between you and the buyer depends on your contract and local law, and it often turns into a dispute. That's another reason to agree in writing, before the first payment, that bank details are never changed by email.

Payment terms help too

Under a letter of credit or a documentary collection, the money moves between banks against documents, which leaves much less room for a fake "pay this account" email, though you should still check the account named in the credit or the collection instruction. For direct transfers, see export payment terms compared. Fraudsters also like moments when you're slow to answer, such as long holiday closures; send a short reminder of your rule before them.

How RelaySolo helps with this

RelaySolo doesn't detect fraud, and no app replaces a phone call to check. What it does: your client records, email history and files are stored on your own computer, not on our servers, and email is sent through your own email account (where your data lives). Each buyer has a client page with what you've discussed and quoted, so you can check what was actually agreed before you act on any change. In the inbox, you can read every buyer email in your own language, which makes odd wording easier to notice.

The Mac app is free to try for 30 days for your first company. Create an account on relaysolo.com to download it.

Sources

Read next

Before any of this, relaysolo.com covers how to spot a suspicious new inquiry: how to reply to a new inquiry.

More in Fraud and safety