Guide

How to stop wire fraud and fake bank-detail changes

Never change where you send money because of an email, a PDF or a chat message. Call the supplier or buyer on a phone number you already had before the request, confirm the new details with someone you know, and have a second person approve. If a wire has already gone to a fraudster, call your bank's fraud line at once and ask for a recall.

Reviewed by Tyler Kober · Updated October 12, 2026

Key takeaways

Bank-detail change requests are the most common setup for wire fraud between trading partners.
Verify by calling a number you had on file before the request; never the number in the email or the new invoice.
Two-person approval on any new or changed beneficiary stops most single-point mistakes.
Check the sender's domain letter by letter; lookalike domains differ by one character.
In the first hour after a bad wire, the bank call matters more than anything else.

How do you avoid wire fraud and fake bank changes?

Treat every request to change bank details as unverified until you have called the other party on a phone number you already had before the request. Confirm the new account with a person you know, get a second person in your business to approve, and send a small test payment first. Never act on bank details that arrive only by email, PDF or chat.

The fraud has a name: business email compromise (BEC). It is not technically clever. It works because it arrives at the right moment, looks like routine paperwork and asks for one small change. In closeouts the moment is always the same: a balance is due, a truck is booked, and someone wants it done today.

How the scam works in a closeout deal

Access or imitation. The criminal either gets into a real mailbox (a phished password at the seller, the buyer, a broker or a forwarder) or registers a lookalike domain, such as one letter swapped or a different ending.
Watching. With mailbox access, they read threads quietly for days or weeks. They learn names, deal amounts, signatures and when payment is due. They may set a rule that hides replies from the real owner.
The switch. Just before payment, an email arrives in the existing thread: "Our bank is under audit, please use our new account," with an invoice that looks exactly like the old one except for the bank block.
The pressure. "The truck is confirmed for tomorrow, please send today so we can release."
The cash-out. The money lands in an account controlled by the criminal or a money mule and is moved on quickly.

Both sides lose. The buyer has paid but the seller has not been paid, and the seller still holds the load.

Warning signs

Any change to the bank, account name, country or bank location, however it is explained.
The new account is in a different name from the company, or in a different country from the company.
A sender address that is almost right: an extra letter, a hyphen, a swapped character, or a free webmail address.
Reply-to address different from the From address.
Language that is slightly off from the person's usual style, or a new signature.
Unusual urgency, secrecy ("do not call, I am in meetings") or a request to keep it between you.
An invoice PDF that has been edited only in the bank block.

The call-back procedure

Step	What to do	Why
1	Freeze payment the moment details change	Nothing is lost by a short delay; a lot is lost by a wrong wire
2	Find the counterparty's number in your own records from before the request	The email's number goes to the fraudster
3	Call and speak to a person you know or have dealt with	A stranger on the line proves nothing
4	Ask them to read the full new details to you; do not read them out yourself	You confirm their knowledge, not your email
5	Record who you spoke to, when, and what was confirmed	Evidence for your bank and insurer
6	Second person approves the beneficiary change in your banking system	Stops a single rushed mistake
7	Send a small test transfer and have them confirm the exact amount by phone	Proves the account reaches the right people
8	Send the full payment and tell them by phone that it is sent	Closes the loop

Keep the test transfer small enough that losing it would not hurt. A test only proves the account works; the call-back proves who owns it.

Controls worth putting in place

Two-factor authentication on every mailbox that touches payments, including those of bookkeepers and assistants.
Dual approval in online banking for new payees and for payments above a set amount.
A written rule, shared with your trading partners: "We never change bank details by email. Call us on a known number before paying any changed account."
Check mail rules regularly for forwarding or auto-delete rules nobody set.
Bank details on file: keep a confirmed record for each regular counterparty, with the date and person who confirmed it.
Ask your bank about payee name checking and positive pay services where available.

Worked example: a Friday balance

A bin-store operator owes a balance, B, to a closeout supplier for a pallet order, pickup Monday. On Friday afternoon an email arrives in the existing thread, signed by the supplier's usual contact. It says the supplier's bank has frozen incoming wires for an audit and gives a new account at a different bank, in a different city.

The operator stops. The account changed, so the procedure applies, whoever signed it.
They look up the supplier's phone number in their contact list, saved from a call two months earlier.
The usual contact answers and says they sent no such email. The bank has not changed.
The operator wires B to the account already on file, confirmed by the call.
They forward the fake email, with headers, to the supplier, who resets their passwords and finds a forwarding rule they never created.

Cost of the check: a five-minute call. Cost of skipping it: B gone to the fraudster, and B still owed to the supplier.

What to do in the first hour

Call your bank's fraud line now. Ask for an immediate wire recall and ask them to contact the receiving bank to freeze the funds. Give the amount, date, time, receiving bank, account number and reference.
Call the real counterparty on a known number so they know their email or yours may be compromised.
Report. In the US, file with the FBI's Internet Crime Complaint Center (IC3) as soon as possible and report to the FTC. Elsewhere, report to your police and national fraud agency.
Secure email. Change passwords, turn on two-factor authentication, remove unknown forwarding rules, and check which devices are signed in.
Keep evidence. Save the emails with full headers, the fake invoice and your call notes.
Ignore anyone offering to recover the money for a fee. That is usually a second scam.

Mistakes to avoid

Replying to the email to "confirm." The criminal controls that thread and will confirm.
Calling the number in the new invoice. It goes to the fraudster or an accomplice.
Letting the approval rule bend for a regular partner. Regular partners are exactly whose email gets hijacked.
Waiting until Monday to call the bank. Every hour lowers the chance of a freeze.
Thinking only buyers are at risk. Sellers' outgoing refunds and payments to their own suppliers are targeted too.

Wire fraud is one of several threats covered in our payments and fraud guide. To understand why wires are used at all, read how closeout buyers pay. Sellers should also read how to spot a fake buyer, and buyers how to spot a fake liquidation supplier. Retailers selling surplus should see our page for retail sellers. The same rule applies on Skyline Dealz Marketplace: payment terms are agreed in writing on each deal, the website never shows bank details, and any bank details should be confirmed by phoning a number listed on the official Skyline Dealz website. If you have inventory to move, you can get an offer for your inventory.

Frequently asked questions

Why do fraudsters target closeout deals?

Closeout deals are large, paid by wire, done quickly and often between people who mostly communicate by email and messaging apps. A criminal who reads a compromised inbox can see when a balance is due and send a convincing "new bank details" message at the right moment. The urgency of closeout pickups makes busy people less likely to stop and check.

How do I verify new bank details from a supplier?

Call the supplier on a phone number you already had before the change request, for example from your contact records or a past call, not from the email, the invoice or a website link in the email. Ask a person you know to read the new account details to you. Then have a colleague approve the change before any payment goes out.

Can a bank reverse a wire sent to a fraudster?

Sometimes, if you act very fast. Your bank can send a recall request to the receiving bank, which may freeze the funds if they are still in the account. Once the money is moved on, recovery gets much harder. Call your bank's fraud line first, then report to the FBI's IC3 in the US or your national fraud agency elsewhere.

Is a small test transfer worth doing?

For a first payment to new details, yes, as an extra check after the call-back. Send a small amount, then ask the recipient to confirm the exact figure by phone on the known number. It proves the account belongs to them. It does not replace the call-back, because a fraudster who controls the email can also reply to a test.

Sources

Selling or buying closeouts?

Get an offer for your inventory Request access

Send a list or manifest and we'll come back with an offer. Approved buyers see live loads, prices and manifests. Or call +1 215 278 4122.