Your Supplier Emailed New Bank Details From Their Real Address

A long-time supplier emails your accounting team to say they have switched banks, and the new payment details are attached to the invoice. The message comes from the same address you have used for years. It is sitting inside the same email thread you have been using all month, with the full history quoted underneath. The tone matches. The signature matches. Nothing looks off, because nothing is off about the email itself. The account that sent it really does belong to your supplier. It has just been taken over by a criminal who is now reading the mail and writing back as if nothing happened.

This is the version of invoice fraud that catches careful people. Most advice about fake invoices tells you to check the sender address for a tiny misspelling, or to watch for a brand-new account pretending to be someone you know. That advice stops a lot of attacks. It does nothing here, because the sender is genuine. The criminal did not imitate your supplier. The criminal logged into your supplier's mailbox. Security professionals call this inbound vendor account compromise, or thread hijacking, meaning the attacker hijacks a real email conversation from inside a real account. For a business owner in McKinney or anywhere across North Texas, the practical question is simpler. A trusted email just asked you to send money to a new place, and you need to know what to do in the next hour.

Why This Scam Gets Past Every Check the Sender Rule

Every payment-safety habit most companies train into their staff assumes the attacker is on the outside trying to look like an insider. A slightly wrong domain name, a free email account, a reply-to address that does not match. Those are the tells of someone imitating your supplier from a distance. Thread hijacking removes all of them in one move. When an attacker controls the supplier's actual mailbox, the email passes every technical check your email system runs, because it is a real message from a real account on the real mail server.

The attacker usually does not rush. They sit quietly in the mailbox for days or weeks, reading the back-and-forth, learning which invoices are due, how your two companies talk to each other, and who signs off on payments. When a genuine invoice is about to be paid, they step into that exact thread and send the bank-change request. They often set a quiet mailbox rule so their messages and your replies skip the supplier's inbox, which means the real supplier never sees the conversation happening in their own name. By the time anyone notices, the payment has moved to an account the criminal controls, and from there it is split and moved again within hours.

The reason this matters to your business and not just your IT staff is money and relationships. The amount is whatever that invoice was for, which for most firms is a real number. The damage does not stop at the dollars. Your supplier may believe you were careless, you may believe they were, and a working relationship that took years to build turns into a dispute about who is responsible. Learning the shape of this attack is the first step, and it is why we built a dedicated page on business email compromise that explains the whole family of these scams in plain terms.

The First Hour Decides Whether You Lose the Money

Treat any email that changes where money goes as a stop sign, no matter how familiar it looks. The single most important thing your accounting team can do is refuse to act on bank details that arrived by email until a human being has confirmed them out loud. Hold the payment. Nothing bad happens if a legitimate bank change waits two hours for a phone call. A great deal of bad happens if a fraudulent one goes through because someone did not want to seem difficult.

Then call the supplier to confirm, and this is the part that most people get wrong under pressure. Call a phone number you already had on file before this email arrived, from an old invoice, a signed contract, or your own contact records. Do not call the number in the new email or the new invoice, and do not reply to the email to ask whether it is real. If the attacker controls the mailbox, they will happily answer your reply and confirm their own fraud, and any phone number they give you rings at their desk, not your supplier's. Reaching the right person on a known number is the whole game. A supplier who genuinely changed banks will not mind the verification call. A supplier whose email was hacked will be grateful you caught it, because you may be the first person to tell them they have a problem.

If you cannot reach anyone and the pressure to pay is real, the safe answer is still to wait. Urgency is a tool the attacker is using on purpose. Language about a late fee, a held shipment, or a closing window exists to push your team past the verification step. A real supplier relationship survives a one-day delay. A wire sent to a criminal often does not come back.

If the Payment Already Left Your Account

Sometimes you are reading this after the money is gone. The verification call that should have happened did not, the payment went out, and now the real supplier is asking where their money is. You still have moves, and the clock is the most important factor in all of them.

Call your bank immediately and ask for a recall or a fraud hold on the payment, using those words. Tell them you are the victim of a business email compromise and need an emergency recall. Banks can sometimes claw a payment back, but only in a narrow window, often measured in hours, before the receiving account is emptied. The faster you call, the better your odds, which is why this is a phone call and not an email or a web form. If the money went out as a wire transfer, the recovery path and the deadlines are specific, and we walk through them step by step in our guide on how a North Texas business recovers the money after a fake invoice wire. If it went out as an ACH payment, which is the slower bank transfer most companies use for routine vendor bills, the first-hour actions are different, and we cover exactly what your accounting team should do in our walkthrough on a fraudulent ACH payment and the first hour.

After the bank, report it. File a complaint with the FBI's Internet Crime Complaint Center, because wire and payment fraud reports feed a process that occasionally freezes criminal accounts, and because an insurance claim will usually expect a report on file. Preserve everything. Do not delete the emails, and do not let anyone clean up the supplier's mailbox before it can be examined, because the record of how the attacker got in and what they touched is the evidence that settles the dispute later. This is the same discipline that makes a named incident easier to contain, which we saw in how the McKesson breach turned into fake invoices aimed at North Texas practices.

Who Actually Pays for the Loss

Once the shock passes, the hard question arrives. You paid money to a criminal because of an email that came from your supplier's hacked account. Is that your loss or theirs? The honest answer is that it depends, and it is worth understanding why before the finger-pointing starts.

Your bank is usually not the one who absorbs it, because from the bank's point of view you authorized a payment to the account number you provided, and payments in the United States settle on the account number rather than the name. Between you and your supplier, responsibility turns on a few things. What your contract says about verifying payment changes, if anything. Whose mailbox was actually compromised, which the email records will show. And who was in the better position to catch it. If your supplier's account was taken over and they had weak protection on it, that weighs one way. If the warning signs were obvious on your end and your team skipped the verification call, that weighs the other. We lay out the whole framework, in plain language and without legal jargon, in the answer to who pays in the FAQ on our business email compromise page.

The practical takeaway is that this is a question for your lawyer and your insurer, not something to settle in a heated phone call the afternoon it happens. What you can do immediately is protect your position by preserving the evidence and documenting the timeline, so the liability conversation rests on facts rather than on whoever sounds the most certain.

Protecting the Supplier Relationship and Your Insurance Claim

A vendor fraud event damages two things that are easy to overlook while you are focused on the money. The first is the relationship with a supplier you presumably want to keep working with. The second is your ability to make a clean insurance claim. Both are helped by the same behavior, which is calm, documented, and prompt communication.

With the supplier, remember that one of you has a hacked mailbox and it may well be them. Approaching the conversation as a shared problem, rather than an accusation, tends to get both companies to the real cause faster. The supplier needs to secure their account, reset passwords, remove any hidden mailbox rules, and check whether other customers got the same message, because you are rarely the only target when a vendor's email is compromised. Offering to share what you saw helps them clean up and helps you both avoid a repeat.

With insurance, the details matter more than business owners expect. Coverage for this kind of loss often lives under a specific part of a cyber policy, sometimes called social engineering fraud or funds transfer fraud, and those sections frequently carry their own lower limits and their own conditions. Some policies require that you had a verification process in place and followed it, which is one more reason the call-back habit protects you twice, once by stopping the fraud and once by preserving your claim. A review of where email-based fraud fits your coverage is part of the broader email security picture, and it is a conversation worth having before you need it rather than during the claim.

How a Plano or Frisco Business Keeps This From Happening Again

Response is the priority, because that is what saves the money in front of you today. Prevention is what keeps you out of the next one. The good news is that the controls that stop thread hijacking are mostly habits and simple settings, not expensive technology, and a business of almost any size in Plano, Frisco, Allen, or the rest of Collin County can put them in place.

The habit that matters most is the one already described. Any change to banking details gets confirmed by a phone call to a known number, every time, with no exceptions for familiar senders or urgent tone. Write it down as a policy so it does not depend on whether a particular person felt suspicious that day. Pair it with a second set of eyes on payments above a threshold you choose, so no one person can move significant money on one email.

On the technical side, the two highest-value steps protect the mailboxes themselves. Strong multi-factor authentication, meaning a second proof of identity beyond the password, makes it much harder for an attacker to log into an email account in the first place, which is where this whole attack starts. Watching for the quiet mailbox rules that hijackers create to hide their tracks catches the ones who do get in. Because vendor fraud often begins with credentials stolen and sold long before they are used, keeping an eye on whether your logins have surfaced in a breach through dark web monitoring buys you early warning. And because the ugliest version of any email attack ends in ransomware or data loss, tested backups through a proper data backup plan keep one bad click from becoming an existential event. None of this is exotic. It is the quiet infrastructure that lets a small North Texas business shrug off an email that would have cost a less-prepared competitor a painful week.

Talk to Someone Before the Next Invoice

If a bank-change email just landed and your team is not sure, or if a payment has already gone out and the clock is running, do not guess. Call us at 512-518-4408 and we will walk you through the next hour. If you would rather get ahead of it, a short conversation now about how your payments and mailboxes are protected is far cheaper than a recovery later. Reach out through our contact page or start with a free security assessment, and we will help your McKinney, Plano, or Frisco business make sure the next new bank details are the real ones.

Frequently Asked Questions

How can an email be fraudulent if it came from my supplier's real address?

Because the criminal is not imitating your supplier, they are inside your supplier's actual email account. They stole or guessed the login, read the existing conversations, and then wrote to you from the genuine mailbox inside a genuine thread. Every technical check your email system runs will pass, since the message really did come from the real account. The only reliable way to catch it is to confirm any bank-detail change by phone on a number you already had, not one from the email.

We just got a bank-change request from a vendor. What is the one thing to do right now?

Hold the payment and call the vendor on a phone number you already have on file, from an old invoice or your contract, before you send a cent. Do not reply to the email to ask if it is real, and do not call a number printed in the new message, because both of those reach the attacker if the account is compromised. A legitimate bank change will wait for a five-minute phone call. A fraudulent one is counting on you not making it.

The money already went out. Is it too late to get it back?

Not necessarily, but you have to move fast. Call your bank immediately, say you are the victim of a business email compromise, and ask for an emergency recall or fraud hold on the payment. Banks can sometimes reverse a transfer, but usually only within a short window before the receiving account is emptied. Then file a report with the FBI's Internet Crime Complaint Center and preserve all the emails. The faster the bank call happens, the better your odds of recovery.

If our supplier's email was hacked, does that make the loss their responsibility?

Not automatically. Your bank generally will not absorb it, because payments settle on the account number you authorized. Between you and the supplier, it depends on your contract's verification terms, whose mailbox was actually compromised, and who was better placed to catch the fraud. It is a question for your lawyer and your insurer, not a phone argument on the day it happens. The best thing you can do immediately is preserve the evidence and document the timeline so the decision rests on facts.