Payment instruction fraud: 6 measures against the “our bank details have changed” email

In business email compromise (BEC), the attacker usually takes over a single email account and watches the correspondence for weeks. When the moment is right, they send the message “our bank account has changed” from inside a genuine invoice thread. Because it comes from a familiar address, in a familiar tone and for an expected payment, nobody is suspicious.

Shipping, foreign trade and construction companies, where high-value and international payments are frequent, are the prime targets of payment instruction fraud. Flawless AI-generated text and voice imitation make it harder still.

Six measures against payment instruction fraud

• Second-channel verification: a change of bank details is never accepted by email; it is verified by calling a telephone number already known to you.
• Multi-factor authentication: on every mailbox, without exception.
• Forwarding rule checks: attackers place hidden forwarding rules in the mailboxes they take over; we scan for those rules regularly.
• SPF, DKIM and DMARC: these make your domain harder to spoof and let the other side verify you.
• Lookalike domain alerts: we flag emails from domains that differ from yours by a single character.
• A payment procedure: dual approval and a written checklist for payments above a set amount.

Technology is not enough; a procedure is essential

What these attacks have in common is that they persuade a person rather than defeat a technical control. That is why we put technical controls in place together with short training for the accounts and operations teams and a written payment procedure. See our Cyber Security page for details.