The pattern is always the same and it works because it attacks routine, not computers. You receive an invoice from a supplier you have worked with for years. The name matches, the amount matches, even the correspondence history below it matches. One thing is different: the account number.
How the fraudster knows what to write
Usually because they got into one of the mailboxes — yours or your supplier's — earlier. They read the correspondence for weeks and learned who pays whom, how much and in what tone. That is why the message has none of the typos and odd phrasing we were all taught to look for.
Sometimes there is no break-in at all: an address differing by a single letter is enough. Nobody reads it character by character in a mailbox with a hundred messages a day.
How to spot it
- A changed account number — always, without exception, a red flag. Companies do not change bank accounts every quarter.
- Urgency — „please pay today”, „accounts are closing the month”. Time pressure exists to switch off the instinct to check.
- A request for discretion or not to call.
- The sender address visible only when expanded — the display name matches, the address does not.
One rule that stops it
A change of account number means a phone call to the supplier. Not a reply to the e-mail, not the number given in that message — a call to the number you have had on file for years. It costs two minutes and is the only safeguard that works regardless of how well prepared the attack was.
Write it down as a procedure rather than good practice. Whoever makes the payments must be allowed to stop one without justifying themselves.
If the transfer has already gone out
Time is everything. Call your bank immediately and report suspected fraud — with a fast reaction the funds can sometimes be held. Then report it to the police and tell your supplier, because if it is their mailbox that is compromised, the next companies are already in the queue.