Our take: The most expensive fraud small finance teams face usually shows up as a polite email from a vendor you already pay. The best defense is often a phone call to a number you already have.
Why it matters: Businesses reported more than $3 billion in business email compromise losses to the FBI in 2025. In October, one redirected construction payment cost the city of Mobile, Alabama $14.7 million.
By Ray Fu, Co-Founder & CEO at Nickel.
The short answer: A vendor bank change scam is when a criminal takes over your supplier's email, or fakes it, and asks you to send future payments to a new bank account. Once you send the money, the criminal withdraws it right away. In our experience, you usually have about 24 hours to call your bank and stop it, and after that the money is usually gone for good. So the best defense happens before the payment goes out. The fix is simple. Before you change a vendor's bank details, call them at a number you already had, not one from the email asking for the change.
When you picture the kind of cybercrime that drains a company's bank account, you probably imagine something technical. Picture ransomware locking every laptop in the office or a hacker slipping into a database overnight. The real threat is more boring than that. Plain, ordinary-looking emails cost businesses close to 100 times more than ransomware did last year. In its 2025 Internet Crime Report, the FBI counted about $3.05 billion in reported losses from what it calls business email compromise, compared with roughly $32 million from ransomware.
Business email compromise, or BEC, is the FBI's name for scams where someone pretends to be a person or company you trust to get money sent where it shouldn't go. The version we worry about most at Nickel is the vendor bank change scam, because it targets exactly the kind of payments our customers send every day. It usually starts with a friendly note along the lines of "Hi, we've changed banks, please update our details before the next payment." One reply and one edit to your vendor record is enough to send your next payment to a criminal instead of your supplier.
The Association for Financial Professionals found in its 2026 Payments Fraud and Control Survey that roughly three in four organizations dealt with BEC in 2025. They also found that criminals are pretending to be vendors more often and executives less, because people have learned to spot the fake-CEO email. A note from a supplier you've paid for years doesn't set off the same alarms.
How a vendor bank change scam works
The details vary, but most of these scams follow the same steps.
- The fraudster learns who you pay and roughly when. Contract awards on public projects are public record, as a retired FBI supervisory special agent told FOX10. For private businesses, the details often come from a vendor's own compromised email account.
- They get into the supplier's email, or fake it. Some hack a real supplier's inbox, often with a phishing email. Others set up a lookalike address that a busy person won't notice.
- They build familiarity before asking for anything. Some spend months trading friendly emails with your staff, and researchers at the email security firm Barracuda have seen criminals jump into existing email threads, so their message shows up in a conversation you already trust.
- They ask for the change, often with paperwork attached. That might be a fake bank confirmation letter or a real invoice they've gotten their hands on.
- They move the money quickly. As soon as your payment lands, they wire it out, often to an account overseas. In our experience, you usually have about 24 hours to catch it and get your bank involved. After that, the odds drop fast, and Mason Wilder, research director at the Association of Certified Fraud Examiners, told FOX10 that after 48 to 72 hours the chances of getting the money back are very slim.
Mobile, Alabama paid a routine invoice to the wrong account
The clearest recent example comes from Mobile, Alabama. A fraudster posing as B.L. Harbert International, the contractor building the new Regions Arena, spent months getting friendly with city staff and eventually obtained a genuine invoice to copy. In October the city sent what looked like its regular monthly arena payment, $14.7 million, to an account the fraudster controlled, and nobody noticed until the real contractor asked why it hadn't been paid, according to what city officials told the City Council.
What makes Mobile worth studying is how ordinary it all looked. Payments had run smoothly for about 18 months, and the copied invoice helped the request pass supervisory review. As Mayor Spiro Cheriogotis put it, "The payment itself was fairly routine. The only difference was where it was going." Local reporters have suggested it may be the largest fraud of its kind ever to hit an American city.
Why small finance teams are the main target
AFP's research notes that larger organizations face more payments fraud overall, so this isn't a problem only small teams have. The difference is what happens after a convincing email shows up. Big companies have extra people and checks to catch it, and small teams usually don't.
Small companies also see more of these attempts per person. Barracuda's analysis of millions of emails sent during 2021 found that an employee at a company with fewer than 100 people received about 350% more social engineering attacks than an employee at a larger enterprise.
There's also usually no second pair of eyes. At a large company, the person who edits a vendor's bank details is usually not the person who releases payments. On a finance team of two or three, the same person often receives the email, updates the record, and sends the payment, which leaves nobody positioned to notice that something is off.
Preventative controls are easy, but using them every time is hard
Most of the protection comes from one rule. Verify every bank-detail change through a channel you already trusted before the request arrived, and never through anything that came with the request.
- Call a number you already have. Use the phone number from your original contract or an invoice that predates the request. Ask the person you reach to read the new routing and account numbers back to you, and note who you spoke with and when.
- Make the call yourself. AFP says criminals have started faking voices, so treat an incoming call about a bank change with the same suspicion as the email.
- Pause payments while a change is confirmed. Hold any scheduled payment to that supplier until the new account is verified, and send any self-service form or portal link only to the contact already on file.
- Separate the change from the payment. This is segregation of duties. Even on a two-person team, the person who edits a vendor's bank details should not be the one who approves the next payment to that vendor.
- Read the request for pressure. Urgency, a payment that comes due right after the change, or an account holder name that doesn't match the vendor's legal name are all reasons to slow down.
- Know what to do in the first hour. If a payment goes to the wrong place, call your bank right away to recall the transfer, then file a complaint with the FBI at ic3.gov. You usually have about 24 hours.
What Nickel does before money moves
Most of these schemes depend on one moment, when someone on your team copies bank details from an email into your system. Nickel's vendor setup takes that step out of your inbox. The vendor enters its own business, tax, and bank details through a secure link, and Nickel verifies the business and its bank details before you send the first payment. Payments then go out through Nickel Bill Pay, where you can require approvals before money leaves your account.
Verification during vendor setup confirms the details you start with, and Nickel keeps checking after that. When it’s time to update your vendor records, Nickel sends a link directly to your vendors to review and update their information. Each time bank information is adjusted, Nickel requires vendors to sign into their bank account for additional verification.
In our experience, that bank sign-in step usually stops this kind of scam on its own, before anyone picks up the phone. The call is still worth making as a backstop.
Every bank-detail change deserves one phone call
Nothing about Mobile's payment looked unusual, because the process had worked for a year and a half and the fraudster spent months making sure it kept looking normal. So the check has to be part of the routine, every time bank details change, whether or not anything feels off.
This week, pull up your vendor list, confirm that each supplier has a phone number on file that came from somewhere other than an email, and agree with whoever approves payments that no bank change takes effect until someone has called to confirm it. If you'd like help setting that up in Nickel, our team is happy to walk you through it.
FAQs
What is business email compromise (BEC)?
Business email compromise, sometimes called CEO fraud, is a scam in which a criminal impersonates someone a business trusts, usually by email, to trick employees into sending money or sensitive information. The FBI's Internet Crime Complaint Center recorded about $3.05 billion in reported BEC losses in 2025, the second-costliest crime type in its annual report after investment fraud.
What is a vendor bank change scam?
A vendor bank change scam, also called a vendor bank account change scam, payment diversion, invoice redirection, or vendor impersonation fraud, happens when a criminal takes over or fakes a supplier's email and asks your accounts payable team to update the bank account on file. Your next payment then goes to the fraudster instead of the real vendor.
How do you verify a vendor's bank account change?
Call the vendor at a phone number you had before the request arrived, such as one from the original contract, and ask them to confirm the new routing and account numbers. Never use contact details, links, or attachments from the request itself, and hold payments until the change is confirmed.
Can you get money back after paying a fraudulent account?
Recovery is possible, but it depends on how quickly you act. Call your bank to request a recall and file a complaint at ic3.gov. In our experience, you usually have about 24 hours to stop the transfer, and fraud examiners say the odds are very slim after 48 to 72 hours. Portland, Oregon recovered a $6.7 million payment in 2025 largely because the fraud surfaced within days.
Why do fraudsters target small finance teams?
Employees at small companies receive more social engineering attempts per person, and one person often both updates vendor bank details and sends payments, which removes the second check that would catch a suspicious change. A single diverted invoice can also do serious damage to a small company.
How does Nickel help prevent vendor payment fraud?
During vendor setup, Nickel has vendors submit their own business, tax, and bank details through a secure link, then verifies the business and its bank details before the first payment. When a vendor later updates its bank details, Nickel requires the vendor to sign in to its bank account for additional verification, and teams can require approvals before payments go out. Nickel recommends a phone call to a known contact as a backstop whenever bank details change.
