When a Vendor Changes Bank Details: A Texas Small Business Wire-Fraud Playbook

A familiar supplier sends your bookkeeper an invoice and says its bank account has changed. The amount matches the purchase order. The email sits in an existing conversation, and someone who sounds like the supplier's account manager calls to confirm the change. The payment is due before a Friday delivery. What should your business do next?

Pause the change, not necessarily the purchase. A convincing email thread or voice is not proof that new payment instructions came from the vendor. The FBI describes business email compromise (BEC) as a scam that can use lookalike addresses or access to real email conversations to redirect payments. It has also warned that criminals use AI to produce persuasive phishing messages and imitate trusted people by voice or video. That means the old test—“Does this sound like the person I know?”—is weaker than it once was. Read the FBI's AI warning.

For a contractor paying a materials supplier, a restaurant settling an equipment invoice, or a professional firm paying a subcontractor, a changed account number is a change in where the money goes. Treat it as a separate approval decision from whether the invoice itself is valid.

Why a correct invoice can still be a trap

A payment diversion can start with a forged message from a slightly altered domain. It can also start inside a legitimate vendor or customer mailbox after an account takeover. In that case the sender address, signature, old thread and invoice details may all look right. A follow-up call, text, or video meeting can add pressure; synthetic audio can make the caller seem familiar. The attacker needs only one employee to replace a stored payee account or authorize a one-time transfer.

These patterns are not confined to large firms. A small Friendswood retailer with one person handling both purchasing and payments may have fewer opportunities for a second check. A New Braunfels construction company may have many vendors and a fast-moving Friday draw schedule. Neither business needs an expensive security platform to establish a clear payment-change rule.

Watch for a request that changes a bank account, asks for an exception to the normal approval route, or insists that a transfer be sent immediately. Odd grammar is not a reliable screening tool: polished language and believable context can still be fraudulent. Nor is caller ID enough. The FTC's small-business scam guide advises clear invoice-approval procedures and warns that callers can spoof phone numbers.

A six-step rule for every changed payment instruction

Write a procedure simple enough for the person covering accounts payable on a busy day. Apply it to ACH changes, wires, payroll destinations, new remittance portals and requests to pay a familiar supplier into a different account—not just messages that look suspicious.

1. Freeze the destination change

Record the invoice and its due date, but do not edit the payee record or release the payment yet. Tell the requester your company verifies all banking changes. A legitimate vendor can wait while you confirm the destination. If timing is truly urgent, a manager can resolve the business deadline separately; urgency must not waive verification.

2. Contact the vendor through an independent route

Call a number already in your approved vendor record or a number confirmed independently through a reliable channel. Do not use the number, link, QR code or reply address in the change request. For an established supplier, ask for your known contact or its accounts-receivable team. If the usual contact is unavailable, follow a documented escalation route rather than accepting an unverified replacement number.

A call from someone who sounds like the owner or vendor is not the independent check. End it and call back using the trusted number you already hold. For a new vendor without a trusted contact on file, have the person who hired the vendor verify the business and contact route before the payment team relies on it. The FBI specifically recommends independently verifying changes in account numbers or payment procedures.

3. Confirm the exact change, not just the invoice

Ask whether the vendor requested a change to its legal payee name, receiving bank and account ending, effective date, and which invoices it affects. Avoid reading the entire proposed account number to someone who has merely called you; establish whom you reached first. If the vendor says nothing changed, stop the payment, alert your team, and preserve the message for investigation.

4. Separate entry from approval

Have one employee document the callback, the name of the person reached, the trusted number used and the specific change; have another authorized person approve the updated payee before funds move. For a very small shop without two finance staff, the owner or a manager outside the payment-entry step can perform the second review. A written exception for one-person operations is better than an informal assumption that “someone else checked.”

5. Release only through the normal bank process

Use your bank's ordinary payee controls and any dual-approval feature you have enabled. Compare the destination in the final bank screen against the verified record—not just the emailed invoice. If the amounts or account details differ, restart the check. Do not share a login, approve an unexpected multifactor prompt, or let a requester screen-share into the payment workflow.

6. Keep a short audit trail

Save the original request, the invoice, notes of the independent contact, the approver and the payment confirmation in your normal restricted-access system. Set a routine check for whether a vendor's expected payment was received. This record helps your bank, incident responders and insurer understand what happened if fraud is discovered later; it does not itself guarantee coverage.

Example: the urgent replacement bank account

Imagine a Houston-area restaurant replacing a walk-in cooler. Its equipment supplier sends a valid-looking $18,400 invoice, then an email says the supplier's old account was closed and provides a new routing number. The restaurant's manager receives a follow-up voicemail that sounds like the supplier's representative. The delivery is scheduled for Monday.

The accounts-payable employee holds the change and calls the number stored from the supplier's earlier contract, not the number in the email or voicemail. The supplier says its bank has not changed. The manager pays only according to verified instructions and notifies the supplier that its correspondence may have been impersonated or compromised. The voicemail's realism is no longer the deciding fact; the independent verification is.

The same procedure works when a logistics firm receives new freight-broker remittance instructions or a healthcare practice gets a “new payment portal” link from a familiar service provider. What changes is the vendor relationship, not the verification standard.

What security controls add—and what they cannot do

Protect the email and accounting accounts most likely to be used in an attack. Turn on multifactor authentication (MFA) for business email, bank access, bookkeeping software and remote administrator accounts. Prefer phishing-resistant methods where available, and make sure each person has a separate account. CISA's small-business MFA guidance recommends starting with administrators and people handling sensitive data. A manager should also know whom to call when an employee receives an unexpected login or approval prompt.

MFA reduces account-takeover risk; it does not decide whether an authorized employee is sending money to the right recipient. The callback and second approval are process controls for that separate problem. Restrict who may change a vendor's bank details, review mailbox forwarding rules after suspicious activity, and ask your IT provider how it will investigate a compromised account.

Keep reliable backups for the records and systems the business needs to operate, and periodically test that a restore works. Backups are relevant if an intrusion develops into ransomware or a system outage; they will not reverse a wire. The FTC's cybersecurity guide for small businesses covers MFA and off-network backups as distinct safeguards. A retailer should identify how it would process orders if its point-of-sale system goes down; a professional firm should know where client files can be restored from and who authorizes that work.

Ask the insurance question by describing the event

Before renewal, give your agent a realistic scenario rather than asking only, “Do I have cyber insurance?” Start with: An employee voluntarily sends our own money to a fake vendor account after a spoofed or compromised email and a convincing phone call. What part of our coverage, if any, responds?

Compare the actual cyber and commercial crime wording for social engineering, fraudulent instructions and funds-transfer fraud. Ask whether the form distinguishes between an employee who authorizes a payment after deception and a criminal who directly accesses a bank account. Check any separate limit or sublimit, deductible, verification condition, territory restriction and prompt-notice requirement. If a customer pays an imposter using a fake invoice bearing your business name, ask how that different loss would be handled. Coverage depends on the policy and the facts; none of those examples establishes that a claim will be paid.

Then ask a second question: if the same incident exposes customer data or shuts down your systems, what response services, data-restoration costs, third-party liability or cyber business interruption might apply? A crime policy and a cyber policy can address different parts of the event; professional liability may matter if a client alleges a mistake in your professional service. NAIC's cyber-insurance guidance distinguishes first-party costs from liability to others and recommends discussing the policy fit with an agent. The precise form and endorsements matter more than the label on the declaration page.

For a business that regularly sends five-figure wires, bring a sample of its typical and largest transfers to the discussion. BIG – Brock Insurance Group can compare available cyber and commercial crime options through its independent carrier network, alongside the business's existing general liability, property, professional liability and other coverage, without assuming one form fills every gap.

If a payment already went to the wrong account

Move quickly, even if you are still investigating. Have a designated person contact the sending bank's fraud department immediately, identify the transaction and request a recall or reversal and contact with the receiving institution. File a detailed report with the FBI's Internet Crime Complaint Center (IC3); IC3 specifically advises prompt bank contact and a complaint that includes the transaction information it requests. A recall is an attempt, not a promise that funds can be recovered.

At the same time, tell your internal incident lead, contact your IT provider if any email or system account may be compromised, and notify your insurance agent or carrier promptly under the policy's reporting instructions. Preserve the original email, message headers if available, voicemail, invoice, account-change history, approval notes and transfer reference. Do not delete suspicious messages simply to “clean up.” If personal information may have been accessed, seek appropriate legal and incident-response guidance on any notification duties; do not assume every payment scam is a reportable data breach.

Finally, isolate the reason the process failed. Was the callback number taken from the scam email? Could the same employee change a payee and release a wire? Was MFA disabled on the vendor-facing mailbox? Correct the narrow failure, then run a practice scenario with whoever covers payment duties during vacations or after hours.

Put the rule where payments happen

A usable one-page instruction could say: No bank-detail or payment-channel change is approved from an email, incoming call or video meeting alone. Pause; independently reach the vendor through an established contact; document the exact change; obtain a second approval; verify the final bank screen. Give the same rule to the owner, bookkeeper, office manager and anyone authorized to pay an invoice. For busy Texas businesses, consistency is more valuable than a complex policy nobody follows.

If you'd like help checking how wire-fraud and cyber exposures fit your coverage, call BIG – Brock Insurance Group at (281) 482-4244 or request a quote. Our independent team can help you compare suitable options and value across carriers, with guidance grounded in your actual payment process.