Bank details fraud: protecting supplier payments in Morocco

A polite email, a credible attachment, a new account number. The transfer goes out, and it does not come back.

By BelloCommerce

September 6, 2026

You get a message from your regular supplier: they have changed bank, here are the new details, please use them for the next payment. The tone is right, the signature looks right, the attachment is clean — and the transfer will go to an account that has nothing to do with them. It is the most profitable attack against a small business, because it needs no technical skill at all.

An email requesting a change of bank details.

The essentials in five points

The attack breaks nothing: it imitates someone you know and waits for a real payment date.
The only reliable defence is an outbound call: you call, on a number you already held.
Never confirm through the channel that made the request, nor a number given in the message.
The most dangerous moment is urgency, and the urgency is part of the script.
The procedure is written before the incident, because afterwards the conversation is about blame.

1. How the attack actually works

There is no hacking of your bank and no intrusion into your systems. The attacker works on trust and on timing, which is what makes it hard to catch by technical means.

The attacker learns who your suppliers are — often through an already compromised mailbox, sometimes from public information.
They wait for a real invoice, or produce one consistent with your habits.
They write from an address very close to the real one, off by a character, or from the real one if it is compromised.
They announce a change of bank details, with a plausible reason: a new bank, a restructuring, an internal control.
They add time pressure: a deadline approaching, a penalty risk, the usual contact away.
The transfer goes out, and the funds are dispersed before anyone notices.

The critical point is the fifth line. The urgency is not a coincidence of the calendar, it is part of the mechanism: it exists precisely to make you skip the check you would have made with two days in hand.

2. The outbound call-back rule

One rule genuinely protects, and it fits in a sentence: any change of bank details is confirmed by a call you make, on a number you held before the request.

What is proposed	Reliability	Why
Replying to the email received	None	The reply reaches the attacker
Calling the number given in the message	None	The number is part of the script
Checking the sender address looks right	Low	One character is enough, and a real mailbox can be compromised
Comparing signature and layout	Low	All of that is copied in minutes
Calling a number from your supplier record	Good	The channel was not chosen by the attacker
Confirming with a known person, by name	Good	Imitation does not survive a real conversation

The difference between the two blocks is not how careful you are, it is who chose the channel. As long as you use a contact supplied by the request, you are talking to whoever sent it, however vigilant you are.

3. The procedure to write down

A rule known to one person does not protect a business. It has to be written, short, and usable by whoever makes the payment, including when the owner cannot be reached.

Any change of bank details triggers the procedure, with no exception and whatever the amount.
Confirmation is by outbound call to a number from the supplier record.
The person called is identified by name, not only by role.
The change is entered in the record by someone other than the person who pays.
The first transfer to the new account is followed by a confirmation of receipt.
The call, its date and the person spoken to are noted in the supplier file.

The fourth line is the awkward one in a small team and the one that protects most. If the same person receives the request, edits the record and releases the payment, no control exists at all — the same reasoning as the separation of roles in fraud prevention.

Never use a contact supplied by the request itself

This is the only error that really counts, and it cancels every other precaution. Replying to the email, calling the number in the message, writing to the address in the signature: in all three cases the verification is made with the very person you were trying to verify. A check is only worth something if you chose the channel, before the request, and it was already in your supplier record.

4. If the transfer has already gone

The first hours matter more than anything else. The order of actions matters more than covering all of them.

Call your bank immediately to request recall of the funds, before anything else.
Tell the real supplier, through a safe channel, because their invoice is still owed.
Keep the messages, headers included, without forwarding or altering them.
Check whether other supplier records have been changed recently.
Change the credentials of the mailbox concerned if it may have been compromised.
Take the matter to the competent authorities, with the evidence you kept.

The second point surprises people and it is essential: having paid a fraudster does not extinguish your debt to the supplier. You still owe the money, which is why this fraud loses the same amount twice.

BelloPOS

All the features

Mistakes to avoid

Confirming a change of bank details by replying to the message received.
Calling the phone number given in the request.
Treating a correct-looking sender address as authentication.
Giving in to the announced urgency and skipping the check.
Letting the same person receive the request, edit the record and pay.
Not telling the real supplier, whose invoice is still owed.

Frequently asked questions

How do I verify a change of bank details?

By a call you make yourself, to a number that was already in your supplier record before the request, identifying the person you speak to by name. Any other channel may have been chosen by the attacker.

The sender address is correct, is that enough?

No. An address can differ by a single character and pass unnoticed, and a genuine compromised mailbox sends perfectly authentic messages. The appearance of the email proves nothing.

Should the procedure apply even for a small amount?

Yes. The threshold is the first thing an attacker tests, and a known exception becomes the way in. A rule with no exceptions is also easier to apply under pressure.

If we paid the fraudster, is the invoice settled?

No. The payment never reached your supplier, their claim stands, and you remain liable. That is what makes this fraud so expensive: the same amount is lost twice.

Does BelloPOS protect against this?

Not directly: the fraud targets the payment, not the till. BelloPOS keeps supplier records and purchase history from Go onward, which gives you the reference contact to call back. The approval procedure itself is human.

What to take away

This fraud is not detected, it is prevented by a single rule with no exceptions: no change of bank details without an outbound call to a number you already held. Write it down, have it applied by someone other than the person who pays, and hold to it even — especially — when you are told it is urgent.