Hey Pokkit,
I need a bit of urgent help. I work in admin for a construction company, and I think we may have paid an invoice to the wrong bank account.
We got an email from a subcontractor we know with “updated bank details” for an invoice due this week. It looked genuine and matched the job timing, so we processed it. Now the real subcontractor has chased payment and says those aren’t their details.
What should we do first?
Hi, I’m really sorry you’re dealing with that. Yes, this sounds like a payment diversion scam, and it’s important to act quickly.
First steps:
- Contact your bank immediately and ask them to try to stop, recall, or trace the payment.
- Tell your finance manager or leadership team right away.
- Stop acting on the email thread and don’t send any more payments using those details.
- Contact the subcontractor using a trusted phone number you already had, not the one in the suspicious email.
- Keep copies of the emails, invoice, payment confirmation, and any bank details sent.
If you’d like, I can help you draft a quick internal incident summary next.
Yes please. Also, the payment went out about 40 minutes ago. We’ve told our accounts manager, but not the bank yet because I wanted to be sure what this was.
The subcontractor is called and known to us, which is why we didn’t question it enough. I feel awful.
Please don’t be too hard on yourself. These scams are designed to look convincing, especially when they copy real suppliers and expected timings.
Because it was only 40 minutes ago, call the bank now if you can. That’s the most time-sensitive step.
Here’s a simple internal summary you can send:
Subject: Urgent: suspected diverted payment to spoofed supplier account
We’ve identified a suspected invoice/payment diversion incident. A payment was processed today following emailed bank detail changes that appeared to come from a known subcontractor. The genuine subcontractor has now confirmed the bank details were not theirs. Bank contact is required urgently to attempt recall/trace of funds. Relevant emails, invoice records, and payment details are being retained for review.
If you want, I can also draft a message for your bank.
That helps, thank you. Can you draft something short for the bank and another message for the real subcontractor? My name’s Sarah, by the way.
Of course, Sarah.
Message for the bank:
Hello, we need urgent assistance regarding a suspected fraudulent payment made today. The payment was sent following emailed bank detail changes that we now believe were sent from a spoofed email impersonating one of our subcontractors. Please treat this as urgent and advise whether the payment can be stopped, recalled, or traced. We can provide payment reference, amount, account details used, and copies of the related emails immediately.
Message for the subcontractor:
Hello, we’ve identified that a payment intended for your invoice may have been sent to incorrect bank details following a fraudulent email impersonating your business. We’re urgently contacting our bank and reviewing the email trail. Please send us your correct bank details through your usual verified contact process, and we’ll keep you updated.
If you’d like, I can help you make the subcontractor message a bit warmer.
Yes, warmer would be good. We’ve worked with them for years and I don’t want this to sound cold.
Absolutely — here’s a warmer version:
Hello James, we’ve just discovered that a payment intended for your invoice may have been sent to the wrong bank account after we received a fraudulent email that appeared to come from your business. We’re really sorry about this and are treating it urgently. We’ve contacted our bank and are reviewing everything straight away. When you’re able, please send over your correct bank details through our usual verified process, and we’ll keep you updated as we work through this.
You could also add:
We value our working relationship and wanted to let you know as soon as we understood what had happened.
If you want, I can also help you put together a short checklist so this doesn’t happen again.
Yes, a checklist would be great. Something practical I can share with the team after we get through today.
Definitely. Here’s a simple team checklist you can share:
Bank detail change checklist
- Never change supplier bank details based only on email.
- Always verify changes by calling a trusted number already on file.
- Use a second person approval step for any payment detail changes.
- Be extra cautious if the request creates urgency or mentions an upcoming payment.
- Check the sender email address carefully for small spelling changes.
- Keep a record of who verified the change, when, and how.
- If anything feels off, pause the payment and escalate internally.
You’ve done the right thing by acting quickly, Sarah. I hope the bank can still help recover it.
If you need, I can turn that into a short staff notice from Pokkit’s companion for easy forwarding on WhatsApp or email.
