ENFRJoin the waitlist
By organization
Small businessesSecurity done right, your days kept for the business.
Mid-marketA program run every week, across sites and teams.
Enterprise & security teamsQoBot takes the routine, your team does strategy.
Public sectorSteer your cybersecurity, keep agents on their mission.
IT service providers & MSPsYour vCISO service, for every client.
Developers & agentsGive your agents a CISO, through API and MCP.
By need
Security questionnairesAnswered from your evidence, sources cited.
Cyber insuranceRenewal forms drafted, requirements in place.
NIS2, ISO 27001 & other obligationsSOC 2, TISAX, Cyber Essentials too: know what applies, get ready for the auditor.
IncidentsCalm, step-by-step response when something happens.
A security program from scratchA prioritized plan in plain words, then the follow-up.
Support for your CISOBacklog, drafts, evidence and reporting prep.
Somewhere in between? QoBot asks a few quick questions when you join.Join the waitlist

Payment fraud: a supplier sends new bank details. Is it fake?

A supplier emails new bank details just before a payment. QoBot tells you what to check, which number to call, and sets a simple rule for every change of bank details. If the money already left, it guides the first hour.

Join the waitlistFree desktop app · Your own AI · macOS, Windows, Linux
Last updated 5 min readENFR
Example, with a fictional company

Don't pay yet. Three signs don't match: replies go to a Gmail address, the new account is in Lithuania while Packwell invoices from Rotterdam, and the email asks you to confirm by reply. Before Friday's €14,000 payment:

  • Sophie (accounts): call Packwell on the number in the contract, ask them to read the account number aloud · ~5 minYour turn
  • You: approve the change only once Sophie has logged the call · second approverNeeds you
  • Karim (IT provider): publish the DMARC record for your own domain · instructions drafted · ~15 minYour turn
Who does what

Fake bank details: who does what

What QoBot does

  • Reads the email with you and lists the warning signs, in plain words.
  • Tells you which number to call: one you already had, never the one in the email.
  • Writes your rule for changes of bank details, with the names of who checks and who approves.
  • Drafts the notice telling your suppliers that you never accept bank changes by email.
  • Writes the DNS records that stop strangers sending email in your name, for whoever manages your domain.
  • If money left: gives the first-hour steps one at a time and prepares the report for the police and your insurer.

What your team does

  • Make the call-back, and hold the payment until it's done.
  • Approve the procedure and tell the people who pay.
  • Call your bank straight away if a payment already left.
  • File the police report and declare the loss to your insurer.

Is the email fake? The signs to check

Fake bank details arrive by email, often as a new invoice or a letter on the supplier’s letterhead. Read the email for these signs before anything else:

  • Replies go somewhere else. The Reply-To address differs from the sender, or it’s a free webmail address.
  • The address is almost right. One letter changed (packwe11.com), a word added (packwell-billing.com), another extension.
  • The new account is in another country than the supplier, or at a bank the supplier never used.
  • A reason not to check: an audit, a bank merger, an account frozen, a new finance director.
  • Pressure: the payment is due today, the matter is confidential, “confirm by replying to this email”.

An email without these signs can still be fake. A supplier’s mailbox can be hacked: the email then comes from the real address and passes every technical check. The call-back decides, never the email.

The rule that stops it

Three habits, written down and known by everyone who pays:

  1. Call back on a number you already had. Use the contract, an invoice received before the change, or the supplier’s website typed by hand. Never the number, the email or the link in the request. Ask the supplier to read the new account number aloud and compare it.
  2. Two people for any change of bank details. The person who enters the new details isn’t the one who approves the first payment to them. In a small team, the manager approves.
  3. Hold the payment until the call is logged: date, number called, person reached. A real supplier accepts a one-day delay; a fraudster pushes.

Your bank may help too. In the euro area, since 9 October 2025, banks check that the name you type matches the account before a euro transfer leaves; other EU countries follow by 9 July 2027, and UK banks have a similar check. A “no match” means stop and call. A match doesn’t replace the call-back.

The same rule covers an employee who changes their salary account, a customer who wants a refund to a new account, and an “urgent transfer” requested by a manager: call the person on the number you already know.

Money already left: the first hour

Hours count, so don’t wait to be sure.

  1. Call your bank now, on the number from its website or your card. Give the amount, the date and time, and the account the money went to. Ask for a recall of the transfer, or a block if it hasn’t left yet.
  2. Keep the evidence: the emails with their full headers, the invoice, the transfer order. Delete nothing.
  3. Warn the real supplier by phone. Their mailbox may be hacked, and their other customers may be targeted.
  4. Report it to the police. Your bank may ask for the report to process the recall.
  5. Declare the loss to your insurer, within the deadline in your policy.
  6. Check your own mailbox for forwarding rules and unknown sign-ins, and change the password. If it was hacked, follow the incident steps: customer data may be exposed.

Where to report depends on your country:

Country Where to report
Any EU country Europol lists each country’s online reporting service
France A complaint at a police station or gendarmerie, or by letter to the public prosecutor. 17Cyber helps 24/7. If the fraud came through a hacked mailbox and you claim on your insurance, file within 72 hours: the law sets that condition for cyberattack payouts
Germany The online police station of your federal state, or any police station
UK Report Fraud (formerly Action Fraud) for England, Wales and Northern Ireland; Police Scotland on 101 in Scotland

QoBot gives the steps one at a time and prepares the summary your bank, the police and your insurer will ask for: amounts, times, accounts, emails received. It never promises the money will come back.

Stop strangers from using your own domain

Fraudsters also pretend to be you, writing to your customers from accounts@yourcompany.com. Three DNS records stop that:

  • SPF lists the servers allowed to send email for your domain.
  • DKIM signs each email, so receivers can tell it wasn’t forged.
  • DMARC tells receivers what to do with an email that fails both checks, and sends you reports.

DMARC goes in three stages: observe (p=none) for a few weeks while every tool that sends in your name is set up, then quarantine, then reject. Only the last two stages block anything. QoBot lists the tools that send as your domain, writes the exact records for your mail provider, and drafts the instructions for whoever manages your DNS.

FAQ

The email really comes from our supplier's address. Is it safe?

Not on that basis. Fraudsters often write from the supplier's real mailbox after hacking it, so every technical check passes. Only a call to a number you already had confirms the change.

Will the bank refund us?

It depends on your country, how you paid and how fast you call. The bank asks the receiving bank to return the funds; the sooner you call, the better the odds. Some countries, the UK among them, have refund rules for some small businesses: ask your bank the same day.

Do SPF, DKIM and DMARC stop this fraud?

They stop strangers from sending email that claims to come from your own domain. They don't stop a lookalike domain or a hacked supplier mailbox: the call-back rule covers those.

Is DMARC a legal requirement?

No law names it. Data protection law asks for security appropriate to the risk, and DMARC is a common way to protect your domain. Some customers and insurers ask for it.

Can QoBot make the call or block the payment?

No. QoBot tells you what to check and prepares the documents; your team makes the call, and only your bank can stop or recall a transfer.

Sources

Written from QoBot's CISO knowledge, with the sources above. · Last updated 20 October 2026
This page explains the rules in plain words. It isn't legal advice: for a borderline case, ask a lawyer. Report an error
Use caseWhen something happens: a calm, step-by-step incident responseA hacked mailbox, a ransomware note, a lost laptop. What to do in the first hour, who must be told and by when, and what goes in the register.ExampleExample: a one-page security action planSeven actions in order for a 31-person food distributor, each with an owner, a time and a cost estimate. The page a manager reads, prints and forwards to the IT provider.GlossarySecurity words, explained onceCISO, MFA, DMARC, EDR, NIS2, DORA, GDPR and the French acronyms you'll meet (RSSI, PSSI, PRA, PCA), each in two or three plain sentences.

The next fake invoice, stopped before it's paid.

QoBot writes your call-back rule today and checks every bank change with you. Your team makes the calls; you approve.

Join the waitlist
Free desktop appYour own AImacOS, Windows, Linux

Cookie settings

Choose what you allow. Advertising cookies stay off until you say yes.

Strictly necessaryqobot.io only

Always on

Remember your cookie choice and keep the waitlist chat working. Retention: 6 months for your choice, until you close the tab for the rest.

Audience measurementPostHog, EU

Not active

No audience measurement runs on this site yet.

Advertising & conversion measurement0 vendors

Not active

No advertising tag is active on this site. Before we add one, we list it here and in the cookie policy, and this window asks for your choice.

Your choice is kept for 6 months. Cookie policy · Privacy policyConsent ID —