The Invoice That Changed Bank Details (Composite Case)

This composite scenario reflects common business email compromise reports. A finance team receives an email that appears to come from a long-standing supplier, asking to update bank details for an upcoming invoice. The email references a real project and is timed to a genuine payment cycle. A payment is made to the new account. The real supplier later chases the unpaid invoice, revealing the change was fraudulent.

The deception relied on routine and hierarchy. The message matched an expected invoice cycle and used a trusted supplier's name, so the change looked administrative. This summary stays at the level of what the team experienced.

Bank detail changes were accepted by email without a call-back to a known supplier number.

The genuine supplier followed up on the unpaid invoice, prompting an internal review.

A significant payment was lost. A recall was attempted but only part of the funds was recovered.