The supplier we've worked with for 3 years sent an email saying 'we changed our bank account'. They provided a new bank account. We sent money to that account without thinking twice.
The next day the supplier asked 'why did the money go to this account' and it turned out they didn't know about it. The email was fake.
How can we protect ourselves from such a common scam? How should we verify bank account changes with business partners?
Supplier account change fraud is very common. Attackers open an email in the supplier's name and provide new account details.
Protocol: All account changes must be verified by phone and in writing. Don't use email, contact the supplier directly.
Step: Instead of replying to the email, call the supplier's known phone number to verify the account change.
Doki · Phishing awareness training · 2023
we had a similar incident.. but btw an email came looking like the supplier's but the address was slightly different. looks like mail hosting spoofing... edit: no money was stolen but it was sterssful
Supplier account change protocol: 1. Don't finalize anything immediately when an email is received 2. Call the supplier on their known number 3. Ask 'Did you send an account change email?' 4. If yes do a test transfer from the old account to the new one 5. Do the full transfer after verification
check the domain at the end of the supplier email. honestly if it looks different, make a phone call immediately
Correction: I misremembered the figure, it was a bit lower.
Indicators of supplier account change fraud: Urgency, typos, domain different from the known address, transfer request.
If phone verification is required for account changes for all suppliers, how much will the process slow down?
good thing you protected yourself against such a smart scammer! i was lucky you didn't verify the bank account... be more careful next time
I agree with this. If it's your first time, start small; scaling comes later.
Proven by experience.
There's a part I don't understand. Any unwritten clause becomes a point of disagreement later, as both sides remember it differently.
Good luck with that.
Let me summarize the topic, since several different answers were given. If you get three different answers on a topic, the question was asked wrong.
This is my opinion, I'm not claiming it's absolute truth.
I completely agree. Trying to do this alone is the most expensive way.
If permission and scope aren't in writing, don't start that test. Proven by experience.
Doki · Log management setup · 2024
Let me clarify the technical side. Everything goes well for the first three months; problems arise in the fourth.
That's all, sorry if I went on too long.
i can't fully agree with this then i mean most incidents start with a leaked password, not a vulnerability.
We experienced almost the exact same thing last year. The biggest time-waster for us was not knowing who had the final say.
If you post the result here, it will help others too.
This is exactly what we experienced. Payment information changes are never verified through the channel they came from.
Proven by experience.
here's how it went for us.. but when we decide without measuring, we allways end up in the same place.
proven by experience.
ive been dealing with this for a long time. btw if you scld false alarms, nobody will report again.
this is my opinion, I'm not claiming it's absolute truth.