The Email Says the Supplier Changed Banks. The Procedure Says Call Them.

The most costly fraud most small and mid-sized businesses will ever face involves no malware and no technical exploit. Somebody who has been reading a supplier's or a customer's mailbox — or has simply guessed a plausible moment, such as the week an invoice falls due — sends a message from a lookalike address, or from the real compromised one, saying that bank details have changed and the next payment should go to a new account. The invoice is genuine, the amount is right, the tone is familiar, and the payment leaves. By the time the real supplier asks where the money is, it has been moved on. Losses per incident routinely reach five and six figures, insurers treat it as a distinct category, and recovery is uncommon because the receiving accounts are emptied within hours. Banks have added checks that the name on an account matches the intended payee, which catches the crude cases; the sophisticated ones open accounts in names close enough to pass. The control that works is procedural and old-fashioned. Any change to payment details is verified by calling the counterparty on a number already on file — not one in the message — and confirmed by a second person before the master record changes. New suppliers are set up the same way. The procedure fails, when it fails, because it exists in a policy and not in the workflow: the person under time pressure at month-end updates the record because the email looked right, and no system stopped them. The improvement is not more training but making the change impossible to save without the verification fields being filled and a second approval logged. There is a mirror obligation on the other side. Firms whose invoices are being spoofed should tell customers, in every invoice and in person, that they will never change bank details by email alone, and should have their own mailboxes protected with the authentication and multi-factor controls that make the compromised-account variant harder to mount in the first place. Fraud of this kind exploits trust between two honest parties; the fix is that both of them agree, in advance, on how trust gets updated.