Key takeaways
- Fraudsters rely less on technology than on routine, time pressure and willingness to help; clear controls in the process protect you.
- Always confirm new bank details by calling back on a number you already hold, never the number in the change request.
- Master data maintenance, invoice entry and payment approval belong in different hands, and recently changed bank details are checked before each payment run.
- If money has already gone out, contact your bank immediately and try to recall the payment, because every hour counts.
Contents
The scam is often unremarkable: an email in the name of a well-known supplier announces new bank details, and the next payment goes to someone else’s account. Fraudsters rely less on technology than on routine, time pressure and people’s willingness to help. What protects you is clear controls built into the process – not individual gut feeling.
01The most common fraud patterns
A supposed supplier sends a new IBAN by email, letter or phone – often with a genuine logo, a correct signature and a plausible reason such as a change of bank.
Invoices for services that were never provided, or copies of genuine invoices with different bank details.
An apparent instruction from senior management demands an urgent, confidential transfer – typically just before close of business, ahead of a weekend or during the holiday season. Often the request explicitly says not to involve anyone else.
If a supplier’s real email account is taken over, the message looks entirely genuine. Checking the sender alone is then not enough.
02Controls for master data changes
The biggest weak spot is changing bank details in the supplier master record. This is where rules should apply without exception – even when the sender is familiar, the message sounds urgent or a manager asks for it to be dealt with quickly:
- Call back to confirm – always on a phone number already known from the master data or the contract, never on the number given in the change request.
- Four-eyes principle: whoever enters new bank details does not approve them.
- Document every change with the date, the source and the person who confirmed it.
- Review master data changes regularly, especially shortly before payment runs.
- A change request by email is a reason to check, never proof in itself.
03Segregation of duties and approvals
Master data maintenance, invoice entry and payment approval sit with different people. In small teams, compensating controls help, such as a review by the head of the team.
Set clear amount thresholds and approval levels in the system – and do not allow exceptions by email or on a verbal say-so.
Review permissions in the ERP and in online banking regularly. Anyone who has moved to another department no longer needs their old rights.
Practical tip
A change request by email is a reason to check, never proof – always confirm new bank details by calling back on a number you already hold.
04Checks before the payment run
The payment run is the last chance to stop a fraudulent payment. A few targeted checks should therefore come before every approval:
- Check the payment proposal for recently changed bank details.
- Look closely at unusual amounts, new payees and payments abroad.
- Search for duplicates: same invoice number, same amount, same supplier.
- Execute urgent payments outside the regular payment run only with documented approval.
05Raising awareness in the team
Even the best control is of little use if it is bypassed under time pressure. Talk regularly about current fraud attempts, make it clear that checking back with management is explicitly welcome, and give credit when someone spots an attempt. A team that does not see a follow-up question as a sign of mistrust is the most effective protection there is. Short, concrete examples from your own company or industry help, as does a clear point of contact for anyone with a suspicion.
06If it has already happened
- Contact your bankContact your own bank immediately and try to recall the payment – every hour counts.
- Inform & secure recordsInform management and secure all records: emails, invoices, change requests, payment confirmations.
- Report to the policeReport the incident to the police and, where applicable, notify your insurer.
- Inform the supplierInform the genuine supplier via the contact details you already hold.
- Review & adjustReview what happened calmly and adjust your controls.
Note
This guide is not legal or insurance advice. In an actual case, agree the next steps with your bank, the police and your advisers.
07In practice
At KHD Humboldt Wedag, Loretta Schneiders took over accounts payable with a nine-figure annual volume and digitalised invoice approval with SAP VIM. For Element Materials Technology, she handled payables for five German sites and documented every process for the transition to the Global Business Center in Edinburgh. At volumes of this size, clear approval routes and documented controls are not a formality – they are the foundation of every payment run.
Loretta Schneiders
Senior interim finance leadership with an international outlook. Clarity in numbers. Structure in processes. Leadership with impact.