Roger Irwin Computer Services - IT Support Services - Computer Repair - Nelson / Richmond / Tasman
Book an Appointment 03 548-2220

Stop Invoice and Bank Account Change Scams

An email arrives from a supplier you deal with every month: their bank account has changed, so please pay this invoice into the new one. It looks exactly right, because it often comes from their real email account. This is one of the most expensive scams for New Zealand businesses, and it's easy to stop.

How the scam works

  1. A scammer gets into an email account, usually yours or a supplier's, through a phishing email and a fake login page.
  2. They quietly read the mailbox for weeks, learning who pays whom, how much, and how people write.
  3. When a real invoice is due, they send a message saying the bank account has changed, or they edit the PDF invoice and change the account number.
  4. They often set up a hidden rule in the mailbox so replies go to a folder you never see, which keeps the real person from noticing.

The same trick works the other way: your customers get an email "from you" asking them to pay into a new account. Variations include a "CEO" asking someone in accounts to make an urgent payment, or a lawyer or real estate agent's account changing just before a house settlement.

The one rule that stops it

Never change bank details because of an email. Ring the supplier on a phone number you already have, from an earlier invoice, your contacts or their website, not one in the email. Ask them to confirm the new account number.

Make it a written rule for everyone who pays bills, and make sure nobody gets in trouble for slowing a payment down to check.

Other good habits

  • Watch for Confirmation of Payee warnings Most New Zealand banks now check that the account name matches the number when you add a new payee. If your bank says the name doesn't match, stop and check.
  • Be suspicious of urgency "Please pay today", "the old account is frozen", "I'm in a meeting, just do it". Scammers want you to skip the checks.
  • Pay a small amount first For a large payment to a new account, send a dollar and ring to confirm it arrived.
  • Use two people for big payments One sets it up and another approves it in online banking.
  • Turn on two-factor authentication On every email account, so a stolen password alone can't get anyone in. See secure your email account.

If you've paid the wrong account

  • Call your bank immediately Ask for their fraud team and say it's a scam payment. The sooner they contact the other bank, the better the chance of getting money back.
  • Tell the real supplier or customer By phone. Their email account may be the one that was hacked.
  • Check your own mailbox Look for forwarding rules and sign-ins you don't recognise. We can do this for you, and check the rest of your business accounts.
  • Report it To the National Cyber Security Centre and the Police.

Worried your email has been read by someone else? Call us on 03 548-2220.