Guide · Paying safely
“Our bank details have changed”: the email that steals deposits
A changed bank details email is the most common way a deposit is stolen from a genuine job: a criminal who has read the company’s or your email sends new account details on the real company’s letterhead, and you pay the right invoice into the wrong account. The defence is one habit — confirm new bank details by phone, on a number you already have, before every transfer — and since October 2024 most UK banks must reimburse you if it goes wrong anyway.
Key facts
- Since 7 October 2024, banks and payment firms must reimburse victims of authorised push payment (APP) fraud on Faster Payments and CHAPS up to £85,000 per claim, normally within 5 business days, for claims made within 13 months of the payment (Payment Systems Regulator, Specific Direction 20).
- A bank may apply an excess of up to £100 per claim and may refuse only where the customer acted with gross negligence — a high bar that does not apply to vulnerable customers.
- Confirmation of Payee checks the account name when you set up a payee; a “no match” or “partial match” result before a deposit is the moment to stop.
- Email that appears to come from a company’s own domain can be forged unless the domain publishes SPF and DMARC policies; SafeToPay reports now show whether they exist.
- Report the fraud to your bank first, then to Action Fraud (or Police Scotland); the bank’s reimbursement decision does not depend on a police report.
How the changed-bank-details scam works
The scam does not need a fake company. It needs a real job, a real invoice and access to one email account — usually the tradesperson’s, sometimes yours. It goes under several names: invoice fraud, mandate fraud, business email compromise, payment diversion fraud. The mechanism is the same.
Step one: someone reads the email
A criminal gets into the company’s mailbox through a reused password or a phishing link, or into yours. They read quietly for weeks, looking for a thread with a quote, a deposit request and a date.
Step two: the timing
Just before the deposit is due, a message arrives in the existing thread or from a look-alike address (one letter changed in the domain, or a free webmail account “because our server is down”). It has the right job number, the right amount and the right tone, and it says: we have changed banks, please use these details.
Step three: the money leaves
You pay the genuine invoice into a mule account. The money is moved on within hours. The company does not know until it chases the payment; by then the account is empty.
| What you see | What it usually means |
|---|---|
| New bank details in the same email thread | The company’s mailbox has been compromised — or yours |
| New details from a slightly different address | A look-alike domain registered for this one message |
| “Our account is being audited / frozen, pay this account instead” | A pretext for urgency; genuine companies rarely change banks mid-job |
| Confirmation of Payee: no match or partial match | The account name is not the company’s — stop |
| A request to pay a personal name “for now” | A mule account; company invoices are paid to the company |
How to spot it before you pay
The details changed at all
Companies change banks rarely and almost never between quote and deposit. Any change is a phone call, full stop.
The address is not quite right
Compare the sender’s address character by character with the one on the quote. Look-alike domains swap letters (rn for m), add a word (-ltd, -uk) or change the ending (.co.uk to .com). On a phone, tap the sender’s name to reveal the actual address.
Confirmation of Payee disagrees
When you add the payee, your banking app checks the account name against the account. “Match” is reassuring; “partial match” or “no match” means the name on the account is not the company’s. Criminals will tell you to ignore it (“it’s under our accountant’s name”). Do not.
The company’s own email is not protected
Whether an email really came from @example.co.uk depends on records the company publishes in its DNS. Without an SPF policy and a DMARC policy, anyone can send mail that shows the company’s address as the sender, and most mail systems will deliver it. This does not mean the company is dishonest; it means email from them is easier to fake, so the phone-call rule matters more.
What a report shows about the company’s email
Ten-year-old company, accounts filed on time, 29 Google reviews, trading address confirmed by Google. Email security row: mail runs through Microsoft 365, SPF is set, no DMARC policy. Meaning: a forged “from” address on this company’s domain would not be blocked by most receiving mail systems. Nothing wrong with the company — but if a message from them changes the bank details, only a phone call to the landline on the quote settles it.
The full report also shows the company’s registered bank charges (lenders), which is a different thing: a company with a charge in favour of a bank is borrowing, not asking you to pay that bank.
Enter a website address, e.g. example-kitchens.co.uk
What to do before every transfer
- Get the bank details on the quote or a signed contract, at the start, in writing, on a document you have kept. Later emails do not override it.
- Confirm any new details by phone on the number from the quote or the company’s website — not a number in the email, and not by replying to the email. Speak to the person, read the sort code and account number back.
- Add the payee and read the Confirmation of Payee result. Anything but a full match on the company’s legal name: stop and call.
- Prefer a card payment for the deposit. A card payment link or terminal removes the bank-details problem entirely and adds Section 75 protection when at least £100 of a £100–£30,000 job goes on a credit card.
- Send a small test payment first for a large transfer — £1, confirmed by phone — then the balance.
- Keep the trail. The quote, the email and the call log are what the bank asks for if something goes wrong.
If you have already paid
Speed matters most in the first hours, but the reimbursement rules give you more time than that.
- Call your bank now — the number on the back of your card, or 159, the anti-fraud line that connects to most UK banks. Say “I have been the victim of authorised push payment fraud”. The bank can try to recall the funds and must log a reimbursement claim.
- Tell the company by phone. Their mailbox is probably compromised; they need to know, and they should still expect your genuine payment — agree how, and confirm details by phone again.
- Report to Action Fraud (actionfraud.police.uk) or Police Scotland. Keep the reference; it helps, though the bank’s decision does not depend on it.
- Expect a decision within 5 business days for Faster Payments and CHAPS transfers, up to £85,000, unless the bank needs more information (then up to 35 business days). An excess of up to £100 may be deducted. Refusal is only allowed for gross negligence, which the regulator defines narrowly — ignoring a clear “no match” warning and an explicit scam warning from the bank might qualify; being deceived by a convincing email does not.
- If the bank refuses, ask for its final response in writing and take it to the Financial Ombudsman Service, free, within six months.
Card payments follow a different route — chargeback and Section 75 — and international or cryptocurrency transfers are not covered by the APP rules. That is one more reason the deposit belongs on a card.
Frequently asked questions
Will my bank refund me if I paid a scammer’s account by mistake?
Usually yes. Since 7 October 2024, UK banks must reimburse authorised push payment fraud on Faster Payments and CHAPS up to £85,000 per claim, within 5 business days, unless you acted with gross negligence. Claim within 13 months of the payment. An excess of up to £100 may apply.
How do I know if a changed bank details email is genuine?
You cannot tell from the email. Call the company on a number you already have — the quote or the website — and read the details back to a person. If they did not send it, their mailbox has been compromised and they need to know.
What does “no match” on Confirmation of Payee mean?
The name on the account you are paying is not the name you typed. For a company invoice, the account should be in the company’s legal name. Treat a no match or partial match as a reason to stop and phone, whatever explanation the email offers.
Is it safe to pay a company’s deposit into a director’s personal account?
No. A limited company’s invoice is paid to the company. A request to pay an individual “for now” is either poor practice or a mule account; either way you lose the paper trail that reimbursement and Section 75 depend on.
Is the company liable if their email was hacked?
Not automatically. You paid the wrong account, so the debt to the company is usually still owed, and the loss is pursued through your bank’s reimbursement scheme. Some companies share the loss as goodwill; none are obliged to. That is why the phone call is your protection, not theirs.
Does the £85,000 limit cover the whole job?
It is per claim, per payment. A £20,000 deposit is fully within it. Very large single transfers above £85,000 are only partly covered, which is another reason to stage payments.
Sources
- Payment Systems Regulator — APP scams reimbursement requirement (Specific Direction 20; £85,000 cap, 5 business days, 13-month claim window, £100 excess, gross negligence exception).
- Payment Systems Regulator — Confirmation of Payee.
- Action Fraud — reporting for England, Wales and Northern Ireland.
- Financial Ombudsman Service — complaints about a bank’s reimbursement decision.
- Consumer Credit Act 1974, section 75.
- SafeToPay methodology v1.2 — how email security (SPF / DMARC) is read and shown.
Check the company before the deposit leaves
Free, no sign-up, about a minute.
Enter a website address, e.g. example-kitchens.co.uk