Bank details change

A supplier emailed new bank details. Check before you pay.

“Our bank details have changed” is the line most invoice fraud depends on. Fromensics flags it, shows the account the email wants you to pay, and tells you whether this contact has used that account before.

What you’ll see

Don’t pay

Don’t pay this invoice.

It came from sterlingcooper-partners.com, not Sterling Cooper’s usual address, and it asks you to pay an account Sterling Cooper hasn’t used before.

Pay: £12,480.00
For: Invoice 1048
To: LT12 •••• 1000Not an account Sterling Cooper has used before · Lithuania
By: Today

Ask Sterling Cooper to confirm

When you see it: a lookalike address asks you to pay an account your contact hasn’t used in signed emails before.

Verified

It’s really Sterling Cooper.

Signed with the key you confirmed on 12 March. Nothing in it changed after it was signed.

To: GB82 •••• 5432Covered by their signature · Same account as 6 signed emails from Sterling Cooper

A signature proves who sent it, not that the payment is due. If it’s unexpected, call them.

When you see it: the email is signed with a key you confirmed, and nothing it covers changed after it was signed.

Changed after signing

Don’t pay. This email was changed.

Sterling Cooper signed this email, but the bank account in it isn’t the one they signed.

Call Sterling Cooper

Use a number you already have, not one from this email. If you saved the number you called when you confirmed them, it’s shown here.

When you see it: a signed email no longer matches its signature, or it was signed with a different key from the one you confirmed.

Pasted bank account

Fromensics can’t tell who owns an account.

Before you pay it, confirm it with them on a number you already have.

When you see it: you paste a bank account into Check anything. A pasted account is never shown as vouched for.

What Fromensics looks at

The account: the To row shows the IBAN or account number, masked, with its country when the IBAN checksum is valid.
The wording: Says the bank details changed appears under How we know, with the sentence that said it.
Your history: for trusted contacts who sign their emails, Fromensics remembers which accounts they signed, on this computer. That’s where “Same account as 6 signed emails” and “Not an account they’ve used before” come from.
A missed ask: if the rules didn’t notice a payment request, choose It asks me to move money in the report’s More menu.

Make your own bank details harder to fake

If you send invoices, sign your emails. Your contacts who use Fromensics see Verified when the account is the one you signed, and Don’t pay. This email was changed. when it isn’t.

In Settings → Signing, turn on Bank details change only when signed. It adds your promise under the signature. When an unsigned email then asks one of your contacts to change where money goes, Fromensics warns them that a trusted contact asked to change it without a signature.

Questions

Can Fromensics confirm an IBAN belongs to my supplier?

No. It can show that an account matches what your supplier signed before, or that it doesn’t. Only your supplier can confirm a new account, on a number you already have.

Where does “hasn’t used before” come from?

From signed emails you’ve received from that contact, remembered on this computer. It never comes from the email’s own wording, so a scammer can’t write “same account as always” and get a green row.

What if the bank details are in a PDF attachment?

Fromensics reads the email text, and a signature doesn’t cover attachments. Ask suppliers to put bank details in the email itself.

Check an invoice emailDon’t pay, Check first, or Nothing looks off, before money moves.Sign your emailsA quiet line that proves an email came from you.Changed after signingWhat “Don’t pay. This email was changed.” means.