This one targets businesses specifically, and it's quietly one of the more expensive scams around, because the amounts involved are often genuine invoice-sized figures rather than the smaller amounts personal scams tend to ask for.
How it plays out
A supplier you already deal with sends an email, seemingly from their usual contact, saying their bank details have changed and asking you to update your records before the next payment. The email looks right, sometimes because the scammer has actually compromised the supplier's real email account rather than faking it.
The email might be genuinely compromised. The new bank details almost never are.
The one call that stops it
Before updating any supplier's bank details, call them using a phone number you already have on file, not one included in the email, and confirm the change verbally. It takes two minutes and it's the single most effective defence against this entire category of scam.
Worth building into how your business works
A simple internal rule, any change to payment details gets a phone call before it gets actioned, no exceptions, protects a business regardless of how convincing the email itself looks. It costs nothing to put in place and it works.
This is exactly the kind of gap an audit finds
Account security and payment handling are core parts of every Sfinco SMB Cyber Audit. See how an audit works.