A supplier emails new bank details. What should happen next

What invoice redirection and CEO fraud are

When the email arrives

1. 1Do not reply to the email and do not ring any number in it. An Garda Síochána warns that the contact details in the email may put you through to the fraudster. Ring the supplier on a number you held before the email arrived: FraudSMART's guide says to use contact details held on record or the number on the company's own website. Ask the person you deal with there to confirm the change and the new account number. BPFI advises checking the IBAN (the account number) with the payee by calling a known and trusted number.
2. 2Have a second person look at every request to change a supplier's bank details before the change is made. An Garda Síochána advises that every request to change bank account details is brought to the attention of a supervisor. Where one person makes every payment, there is nobody to be that second person. For that business, the call-back on a known number is the check that still applies, along with the bank's name check.
3. 3Hold the first payment to a changed account until the call has been made. The NCSC advises delaying large payments by default to allow for fraud detection.
4. 4Set up dual authorisation in your business online banking, so that two people approve each payment. FraudSMART advises it for every electronic payment to a third party. The NCSC advises two approvers for payments above a set amount.
5. 5Read the result of the bank's name check. Since 9 October 2025, banks and payment providers in euro-area countries have had to check the name you enter against the name on the account before you approve a euro bank transfer (credit transfer). BPFI says the check may also run when you add a new payee or change an existing one in online banking. If a supplier you have paid before comes back as no match or close match, stop and ring them. BPFI advises businesses not to change the payee name to whatever the system shows unless it has been verified. The limits of the check are two sections down.
6. 6Apply the same call-back when a member of staff asks to change the account their pay goes into. The NCSC gives "Please update my direct deposit details before the next payroll" as a warning sign, and BPFI's guidance for businesses says to confirm names and IBANs with suppliers, staff and partners through a trusted channel.
7. 7Treat urgency and secrecy as warning signs, even from your own managing director. Among the signs of an attempt, the NCSC lists emails from executives or suppliers asking for urgent action or confidentiality, and messages asking you to bypass normal processes. FraudSMART warns of the tactic of sending the email when the supposed sender is away from the office and hard to check with.
8. 8Write the procedure down and make sure everybody who can pay a supplier knows it, including whoever covers holidays. An Garda Síochána advises clear policies and procedures for checking payments, known to all employees. FraudSMART and the NCSC both advise training staff on email fraud.

If the money has already gone

1. 1Ring your bank's fraud team now and ask it to stop or recall the payment.
2. 2Ask the bank what it is doing to recover the money. If the account number you gave was not that of the person you meant to pay, your bank must make reasonable efforts to recover the funds, and the receiving bank must cooperate (Regulation 111 of the European Union (Payment Services) Regulations 2018). If the money cannot be recovered, your bank must give you, if you ask in writing, the information it holds that you need to take legal action for it. It may charge you for the recovery if your contract with it says so.
3. 3Report it to your local Garda station. An Garda Síochána asks for invoice redirect and CEO fraud to be reported to the local station and to the bank immediately. It asks for failed attempts to be reported as well, because the bogus account may be in use for other frauds of the same kind, and reporting it may prevent them. The Garda National Economic Crime Bureau takes the more serious and complex cases. The NCSC's guidance lists the NCSC as a second place to report.
4. 4Keep everything. Do not delete the email. Save its headers (the technical details of where it came from), any logs and call recordings, and the transaction details, which the NCSC describes as vital for investigation and potential recovery. Keep the invoice too.
5. 5Find out how the email got in. If it came from your own mailbox or a colleague's, change the password, turn on two-step sign-in, and check the mailbox for forwarding rules nobody set up. The NCSC's steps after an incident include changing compromised passwords, checking for suspicious email forwarding rules, and assessing how the attacker succeeded.
6. 6If the attacker was inside a mailbox or system that holds personal data, assess it as a personal data breach. Under the GDPR, unauthorised access to personal data is a breach. You must report it to the Data Protection Commission without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to people. If it is likely to result in a high risk, you must tell the people affected as well, with some exceptions (Article 34). Every breach, reported or not, has to be recorded. What the first 72 hours require is set out separately.
7. 7Tell the real supplier what happened. The NCSC advises notifying affected parties, such as suppliers and customers, if their data or payments may be at risk, and An Garda Síochána's description of this fraud notes that the business still has the supplier's invoice to pay.

What the bank's name check catches, and what it does not

1. 1It warns and does not block. Banks must make sure the check does not stop you approving the payment (Article 5c(5)). They must tell customers what ignoring a warning means for liability and refunds (Article 5c(7)). A bank that has met the Article's requirements is not liable for a payment sent to the wrong payee on an incorrect account number (Article 5c(8)).
2. 2A similar name can pass. An account in a name close to the supplier's can come back as a close match, showing the account holder's name, which can look like a typo. BPFI warns that an account belonging to somebody else may return a match or a close match if the name is similar. For a business, BPFI says the name is checked against the registered legal name, legal abbreviations and trade names. BPFI advises businesses to reconfirm the name with the payee through a trusted channel and to consider delaying the payment until it is clarified.
3. 3A match only means the name typed matches the account. If the fraudulent email supplies a new account name along with the new account number, and that name is entered, the check compares the criminal's name with the criminal's account and reports a match. A CEO fraud payment to a new payee works the same way.
4. 4Payment files can be outside it. Banks must let a business that sends many payments together, as one file, opt out of the check (Article 5c(6)). BPFI says the opt-out is subject to each bank's terms. If your supplier payments go to the bank as a file, ask the bank whether those payments are checked.
5. 5Some payments are not checked at all. BPFI lists payments in other currencies, card payments, direct debits, paper payments received by post, and standing orders after the first set-up. The SEPA Regulation covers euro bank transfers where both banks are in the EU. A payment to an account at a bank in the UK is outside the Regulation's check, whether it is in sterling or in euro. BPFI says SEPA countries outside the EU and EEA, such as the UK and Switzerland, may offer the check in the future.
6. 6Payment providers in EU countries that do not use the euro have until 9 July 2027 to offer the check, under Article 5c(9). If your business account is with a provider based in one of those countries, ask it whether it runs the check yet.

The email settings behind the fraud

1. 1Two-step sign-in on every email account. The NCSC advises requiring multi-factor authentication (two-step sign-in) on all email accounts. A 2023 case study from the Data Protection Commission describes an attacker who got into a second-level school's systems, email included. The attacker sent the school's accounts administrator a fake email that appeared to come from the principal, with copies of invoices for real work showing altered bank details. The school paid, and found out when the real supplier said it had not been paid. The DPC recommended multi-factor authentication, ongoing monitoring and reminders of the school's email usage policy.
2. 2Forwarding rules checked and controlled. A criminal inside a mailbox can set a rule that sends copies of its mail to an outside address. The NCSC's guidance includes blocking unauthorised forwarding and monitoring forwarding rules among its controls.
3. 3DMARC on your own domain: the setting that tells other mail systems what to do with forged email in your name. The NCSC advises setting up and monitoring SPF, DKIM and DMARC. If your DMARC record asks for forgeries to be quarantined or rejected, a receiving mail system that applies DMARC can send to spam or refuse email that claims to come from your exact domain and fails the check. An example is a forgery of your own managing director's address sent to your staff or your customers. The receiving system always makes the final decision. DMARC does not deal with lookalike domains, or the display name shown beside an address. A record set to p=none expresses no preference about what happens to a forgery. DMARC has its own guide.
4. 4The supplier's domain matters too. FourWinds checked 400 Irish small-business email domains on its own outreach list on 2 October 2026: 61% had no DMARC record, 32% had one set to p=none, and 7% enforced it. An email showing a supplier's real address is not proof the supplier sent it.
5. 5Lookalike domains need their own control. The NCSC advises blocking incoming email from newly registered domains and from domains with small typos. FraudSMART's guide gives a .com address, where the supplier uses .ie, as the kind of change to look for.

What the law requires, and what it does not

The Irish figures, and the samples behind them