Skip to content

Start here

← Field Notes

“Please note our new banking details”

An email in a real thread, from a real supplier, about an invoice you really owe. Only the account number is fake. How invoice redirection works, and the habit that stops it.

5 October 2026 · 3 min read

The message

A reconstruction. The people, companies, amounts and addresses are fictional.

From: Sue Botha · Thornveld Packaging (accounts@thornveldpackaging.co.za)
To: Accounts · Tshedza Logistics
Subject: RE: Invoice INV-20418 for September

Good day,

Please note that following our annual audit we have moved our banking to a new provider. Attached is the confirmation letter on the bank's letterhead.

Kindly update your records and settle INV-20418 (R48,300.00) into the new account before Friday, so that your October deliveries are not placed on hold.

Our landlines are down during the migration, so please send any queries to this email.

Kind regards,
Sue
Accounts Receivable | Thornveld Packaging

Why it works

Nothing in this email is false except the one thing that matters.

Tshedza does buy boxes from Thornveld. It does owe R48,300. The email sits in the same thread as the invoice, from the address Sue always uses. That's because business email compromise usually starts with a real mailbox. A criminal gets into someone's email account, often with a password stolen through phishing, reads along quietly, then writes as that person. Sometimes it's the supplier's mailbox. Sometimes it's yours. Sometimes it's a look-alike address, one letter off.

The request is routine, too. Updating a supplier's details is admin. Paying an invoice is admin. The scam hides inside a task finance teams do every week.

And it stays hidden for a while. Standard Bank notes that businesses often only realise what happened when the real supplier, still unpaid, stops supplying them.

Who carries the loss? Don't assume someone else will. In 2024 the Supreme Court of Appeal heard the case of a buyer whose own email had been intercepted, and who paid R5.5 million of a property price into a fraudster's account. The court found that she had been warned about this kind of fraud, had ways to check the banking details, and hadn't taken reasonable steps to do so. It saw no reason to shift her loss to the law firm she had sued.

The field marks

  • Borrowed trust. A real thread, a real name, a real invoice. The familiar part is the disguise.
  • Authority. An "audit" and a letter on a bank's letterhead. A letterhead is just a picture.
  • Urgency. "Before Friday."
  • Fear. Deliveries on hold.
  • Secrecy. "Our landlines are down." The message closes the one channel that would expose it.
  • The ask. Pay this amount into a new account.

The habit that stops it

Spot the ask. Switch the channel.

The ask here doesn't look like one. Nobody writes "please send money to a stranger". They write "kindly update your records". So treat any change of banking details as the ask, whoever it seems to come from.

Then switch the channel. Call the supplier on the number already in your system: not the one in the email, the signature or the attached letter. Ask for the person you usually deal with, and read the new details back to them. SABRIC, Absa and Standard Bank all give the same advice. Your bank may also offer an account verification service that checks new account details before you pay.

Two more habits make it stick:

  • Nobody changes a supplier's banking details alone. One person captures the change; a second confirms it by phone.
  • Tell your own customers, on every invoice, that your banking details will never change by email. We do.

Sources

Ready when your team is.

Start your teamFree Team Spot Check