Stop, verify and preserve
Use this sequence when instructions change or pressure rises.
Stop the payment
Do not let urgency, secrecy or a promised reward remove the time needed to check.
Verify outside the message
Use a phone number or account contact already known to be genuine.
Read back the full details
Confirm the recipient name, bank details, amount, currency and reason for any change.
Preserve the evidence
Keep messages, call notes, account details, quote terms and transaction references.
Escalate fast after payment
Contact the provider and bank at once to ask about a hold, trace or recall without assuming recovery.
Signals that require a separate check
No single signal proves fraud, but each one changes what a careful sender should do.
| Signal | Why it matters | Safe response |
|---|---|---|
| New bank details | A real email thread can be taken over | Call a known number |
| Urgent secrecy | Pressure blocks normal review | Pause and involve another person |
| Unusual payment purpose | The sender may be asked to hide the true transaction | State the real purpose or stop |
| Guaranteed recovery | Victims can be targeted a second time | Verify the service independently |
A valid IBAN or successful small test does not prove that the payment request is honest.
Example: a changed invoice inside a real conversation
A supplier's genuine email thread suddenly contains new bank details and a request to pay today. Familiar names, history and writing style do not make the change safe because an attacker may control the mailbox.
Call the supplier using a previously verified number. Read back the details and record who confirmed them. Stop if the caller tries to prevent verification.
Evidence to keep
A clear record helps a bank or provider understand what happened.
- Original and changed payment instructions
- Known contact details used for verification
- Names and times of calls
- Transfer confirmation and reference
- Bank and provider case numbers
Design a pause that still works under pressure
Fraud often succeeds by controlling the communication channel rather than by inventing an unfamiliar story. A genuine email thread, invoice style or caller name can be copied or compromised. Treat a new beneficiary, changed account, unusual secrecy request or shortened deadline as a reason to switch channels, not as evidence that the request is genuine.
Use contact information stored before the payment request. Read back the complete beneficiary name and account details, and record who confirmed them and when. For a business payment, the person approving the commercial obligation should not be the only person allowed to approve a beneficiary change. For a personal transfer, involving a trusted second person can interrupt pressure and urgency.
If money has moved, contact the provider and funding bank immediately through authenticated channels. Ask for a hold, recall or fraud escalation as appropriate, but do not assume recovery is guaranteed. Preserve the original messages, headers, payment confirmation, account details, call notes and case numbers. Ignore anyone promising guaranteed recovery or requesting remote access, passwords or another payment.
Use this in the next decision
Changed supplier details are examined in the invoice redirection fraud guide.
If a payment already used incorrect details, follow the immediate wrong-bank-details response.
Before authorizing a new payee, follow the recipient verification process for identity, account and callback checks.
Catch an IBAN typing error
A checksum is one narrow verification layer and does not prove account ownership.
IBAN Format Checker
Check the length, characters and ISO 13616 mod-97 checksum locally in your browser.
Fraud-prevention and recovery sources
These consumer-protection sources support independent verification and rapid reporting. Contact the bank or transfer service through an authenticated channel if money has moved.
Questions that can stop a fraudulent payment
Can a bank reverse an authorized scam payment?
Sometimes recovery efforts succeed, but outcomes depend on speed, route, jurisdiction and whether funds remain available. Report immediately; never assume reversal is guaranteed.
Is a small test payment safe?
It can confirm routing but not the honesty of the person controlling the destination. Independent identity and instruction verification remain necessary.
Are recovery services legitimate?
Some are, but fraud victims are frequently targeted again. Reject guaranteed recovery, upfront pressure and requests for account access; verify any service independently.
This page uses worked reasoning and authoritative references; it does not claim first-hand testing or personalized advice. See our editorial policy.
Use this alongside the cross-border money safety collection to verify recipients, changed instructions and recovery evidence.