Banking Details Change Fraud: A Prevention Checklist for South African Finance Teams

Banking details change fraud is stopped by process first and technology second. Every change to a supplier’s banking details must be verified by phone on a number already on file, approved by a second person and logged. DMARC at enforcement stops criminals spoofing your exact domain, but it cannot stop lookalike domains or a supplier’s compromised mailbox, so the call-back rule is non-negotiable.

How the scam runs

The pattern is consistent enough that most finance teams will recognise it. An email arrives that appears to come from a known supplier, or from your own MD or financial manager. It refers to a real relationship and often a real invoice. It explains that the supplier has changed banks, or that their account is “under audit”, and asks that the next payment, or an overdue one, be made into a new account. The tone is routine, sometimes slightly urgent. A letterhead or a “bank confirmation letter” PDF may be attached.

The payment is made. Weeks later the real supplier asks why they have not been paid. By then the money has usually moved on from the receiving account.

This is the business email compromise (BEC) family of fraud. The FBI’s Internet Crime Complaint Center reported about US$2.77 billion in BEC losses for 2024 in its annual report, and South African organisations face the same playbook, often aimed at the end of month when payment runs are large and staff are busy. The losses are rarely about technical sophistication. They are about a single person being able to change where money goes on the strength of an email.

Three routes, three different defences

Finance teams often treat “the email was fake” as one problem. It is three, and each needs a different defence.

The third route is the hardest. When a criminal has access to a supplier’s mailbox, every technical check passes because the mail is authentic. That single fact is why verification has to happen outside email.

The prevention checklist

Work through this list with whoever owns accounts payable. Each item is a control you can describe, test and evidence.

Verification

• Every request to add or change banking details is verified by phone before it is captured.
• The call is made to a number already on the supplier master file or on a signed contract, never to a number in the requesting email or its attachments.
• The caller confirms the change with a known contact, not whoever happens to answer.
• Verification is recorded: who called, which number, who confirmed, date and time.
• Requests that arrive with urgency, secrecy or “the CEO has approved this” receive more scrutiny, not less.

Supplier master-file controls

• The person who captures a banking change cannot also approve it.
• System access to edit supplier banking details is limited to a small, named group.
• Changes generate an audit trail and a report reviewed by someone outside accounts payable.
• Where your bank offers account verification services, new or changed accounts are checked against the account holder’s name before first payment.
• Suppliers are told in writing that you will never accept banking changes by email alone, and that they should expect your call.

Payment release

• Payments above an agreed threshold need two approvers in the banking platform.
• The first payment to a new or changed account is flagged for additional review.
• Payment approvers can see when an account’s details last changed.
• Any instruction to pay “outside the normal run” requires the same verification as a banking change.

Email and identity

• Your own domain has SPF, DKIM and DMARC at p=reject, so criminals cannot send as you to your suppliers and clients.
• Multi-factor authentication is enforced on every mailbox, especially finance and executive accounts.
• Your mail platform tags messages from external senders.
• Mailbox forwarding rules and inbox rules are reviewed regularly, because attackers commonly create them to hide replies.

DMARC’s role, and its limits

DMARC protects a domain from being used in the From address by anyone who is not authorised to send for it. Once your domain is at p=reject, receiving servers that honour DMARC refuse mail that claims to be from yourcompany.co.za but fails authentication. That matters in two directions.

Protecting your clients from criminals posing as you. If you invoice clients, your domain is a target. A fraudster who can send “updated banking details” as your exact address has an extremely convincing story. Enforcing DMARC removes that option and pushes them to lookalikes, which are easier for your clients to spot.

Protecting your team from criminals posing as your own executives. An instruction that appears to come from your MD’s real address is persuasive. With DMARC enforced, spoofed internal addresses are blocked at receivers that honour the policy.

What DMARC cannot do is equally important. It does nothing about lookalike domains, display-name tricks or compromised real mailboxes, and your suppliers’ DMARC posture is outside your control. Our article on how email spoofing leads to invoice fraud goes deeper into the attack chain, and lookalike domains covers the gap DMARC leaves. You can see your own current position with the free DMARC checker.

The first hour after a suspected fraud

Speed matters more than anything else once money has moved. Agree this sequence in advance and print it.

1. Contact your bank immediately. Use the fraud line or your relationship banker, explain that a payment was made to a fraudulent account, and ask them to attempt a recall and alert the receiving bank. Have the payment reference, amount, date and destination account ready.
2. Stop further payments to the new account and freeze any pending payments to the affected supplier until verified.
3. Preserve the evidence. Do not delete the emails. Keep the original messages with full headers, the attachments and any related correspondence. Headers show where a message really came from and may show whether it was spoofed, sent from a lookalike or sent from a real mailbox.
4. Contact the real supplier on a known number to confirm the situation and let them know their mailbox may be compromised.
5. Check your own mailboxes. If there is any chance the attack started on your side, reset passwords, sign out active sessions, review forwarding and inbox rules, and confirm MFA is active.
6. Report it. Open a case with the South African Police Service and keep the case number for your bank and insurer. Notify your insurer if you hold cyber or crime cover.
7. Assess personal information exposure. If a mailbox was compromised, consider whether POPIA notification obligations apply. Our POPIA and email security article outlines section 22.

Making the controls stick

Most organisations that lose money had a verification rule on paper. It failed because someone was new, the request came from a senior name, the supplier was “trusted”, or it was the last working day of the month. Controls stick when they are designed for those moments.

• Make the rule absolute. “Always call back” survives pressure. “Call back if it seems suspicious” does not, because criminals work hard to make sure nothing seems suspicious.
• Give staff explicit cover. Leadership should say, in writing, that nobody will be criticised for delaying a payment to verify it, including when the request appears to come from the MD.
• Test it. Periodically review a sample of banking changes and confirm each one has a recorded call-back.
• Close the email gap you can control. Put your own domain at enforcement so you are not the brand criminals use against your clients.

MailMarq takes your domain from monitoring to p=reject safely, with every step backed by evidence and approved in writing, then watches it all year for new and failing senders. That closes the spoofing route so your process controls can deal with the rest. Start with a free assessment through our contact page.

Frequently asked questions

MailMarq
MailMarq is a managed DMARC service run from Johannesburg. Our team has built and managed business websites, hosting and email infrastructure for South African companies since 2016, and writes these guides from work on real domains.