Ilia Zavialov on what a team does when a contractor changes bank details

01

Why the message survives every check a team knows

The attacker sits inside the correspondence, reached either through the contractor's mailbox or through the team's own. The thread is real, the signature matches every previous letter, the invoice number belongs to work that has genuinely been done, and the amount is the one that was agreed. The sender address passes any check, because it is the address that has always been used. Every habit a team has built around spotting a fake letter is aimed at something that has not happened here.

The timing is the element that has been chosen. The request arrives in the days when a payment was already expected, so it answers a question the finance side was about to ask. A person who has been waiting for an invoice reads the arrival of one as confirmation that the work is finished and the moment to pay has come. The wait does most of the persuading before a single line has been read.

The FBI complaint center recorded 3.046 billion dollars of reported losses to business email compromise in 2025, which placed the category second behind investment fraud. Behind that figure sits a very ordinary event repeated thousands of times: one person edited one line in one payment record because a message asked for it. The size of the category is made of repetition, and every case looks small from inside the company it happened to.

02

How often a team of any size meets this message

The same complaint center logged 1,008,597 reports for 2025 and close to 21 billion dollars in stated losses, twenty six per cent above the year before. Numbers of that shape describe a background condition. A team that has never received such a request has been lucky with its position in a queue, and the queue moves.

The Federal Trade Commission put losses to business impersonation at one billion dollars for 2025, with the heaviest losses among people who were approached by somebody presenting themselves as bank staff. The identity chosen for the impersonation is always one that carries authority over money. A supplier who is owed an invoice carries exactly that authority inside a small company.

In the United Kingdom, payment industry figures for 2025 recorded 248,070 cases of authorized push payment fraud with 576.4 million pounds taken. Sixty six per cent of those cases began online and a further seventeen per cent through telephone networks. The channels involved are the ordinary ones a business uses all day, which is why no unusual event precedes the loss.

One figure from the same body of data deserves attention on its own. In four out of five impersonation reports no money was lost at all, meaning attempts vastly outnumber successes. The practical reading is that the message will arrive, that arrival is normal, and the outcome depends on what the company has arranged in advance.

03

The object under attack is a decision inside the company

Everything technical in the scheme is delivery. The thing being changed is a record: the account a given supplier is paid to. That record lives somewhere, whether in an accounting system, a spreadsheet or a person's memory, and somebody holds the right to edit it. The scheme depends entirely on that right being informal.

In most small teams the right belongs to whoever happens to be handling payments that week. Nobody wrote the arrangement down, so nobody can point afterwards at the moment when the change was approved. When the money has gone, the reconstruction becomes a conversation about who understood what, and such conversations damage a team long after the sum has been written off.

Naming the right is the first act of defense. Once a company can say which role edits payment records, and what has to exist before an edit is made, the message loses the space it needs to operate in. Ilia Zavialov describes a change of details as a controlled operation with an author, a date and evidence attached, in the same way a company treats a change to who holds the keys.

04

The rule that closes the whole category

Payment details change after a voice confirmation on a number the company held before the request appeared. The number comes from the signed contract, from an earlier invoice, or from the supplier record built when the relationship started. A number printed in the new message carries no standing at all, however plausible the letterhead around it looks.

The direction of the call is where the security lives. A person who dials a number they already hold reaches the contractor by definition, since the attacker controls a mailbox and has no hold over the telephone line. A person who answers an incoming call has no way of knowing who is on the other end. The whole procedure follows from that single asymmetry.

The confirmation costs about a minute, and the minute is worth writing down: the date, the number dialled, the person reached and the change agreed. That line turns a private act of care into something the company owns and can show later. If the person who made the call leaves in six months, the record of the call stays behind.

05

Voice confirmation now carries a weak point of its own

A convincing clone of a voice can be built from a recording of roughly three seconds and reaches around 85 per cent accuracy. In one experiment listeners separated a genuine voice from a synthetic one in 37.5 per cent of attempts, which is worse than guessing. Voice as evidence of identity has weakened recently enough that most written procedures were drafted before the change happened.

What survives the weakening is the direction of the call combined with a shared fact. The team dials a number it held in advance, and the conversation includes a detail both sides knew before the request existed: the number of the previous invoice, the date of a meeting, the informal name the two companies use for the project. A synthetic voice arriving on an unexpected inbound call cannot supply that detail.

Where the size of the relationship justifies it, a second independent path helps. A message in the workspace the two companies already share, or a short video call in which the same shared fact is repeated, gives two channels that would both have to be held at once. The effort required to hold two channels simultaneously is what pushes an attacker towards an easier target.

06

Roles: who may ask, who may confirm, who may pay

Separation of roles is what allows the rule to survive a busy week. The person who receives the request records it and passes it on without acting. Another person makes the callback on the held number. A third approves the payment once the callback exists in the record. In a team of three the same person may hold two of these roles, and the constraint is that receiving a request and approving it never sit with the same individual.

The threshold matters as much as the roles do. Below a modest amount the callback is still made, because an attacker learns a threshold quickly and adjusts the request to sit under it. Above an agreed amount two approvals are required, and the second approver reads the callback record before adding a signature. Both numbers are written into the procedure so that neither is decided in the moment.

Urgency is the pressure this scheme applies, so the procedure has to state in advance what urgency changes. The answer that holds is that nothing changes, and any delay created by a callback belongs to the party that asked for the change. Teams that carved out an exception for urgent payments found that every fraudulent request had been marked urgent.

07

The supplier record as the single place where details live

Payments are made against a record, and the record is updated only through the procedure. Letters, attachments and chat messages serve as evidence and never as the source. Once that is settled inside a team, a message carrying new details has nowhere to land on its own: it becomes a request to open a procedure, which is a much smaller event.

The record holds the account, the date the account was last verified, the person who verified it, and the number used for the callback. An entry with no verification date is a gap, and gaps are found in a short annual review of active suppliers. The review takes an afternoon for a team of ten and produces a list of missing telephone numbers, which is the cheapest possible way to discover them.

That same review catches relationships that have gone quiet. A dormant supplier is the easiest one to reactivate with a message, since nobody in the team holds a recent conversation to compare the request against. Closing a record when a project ends removes the target before anybody thinks to aim at it.

08

The first hour after the money has gone

Speed decides the outcome, and the window is measured in hours. The bank fraud desk is called immediately with a request to attempt a recall, because funds are usually moved onward the same day. The call is made by whoever can answer questions about the payment, with the reference numbers and the account details ready before dialling. Time spent gathering paperwork during the call is time the money uses to move.

The contractor is told through a channel outside the compromised thread. They may not know their mailbox is being read, and other clients of theirs are likely receiving the same request in the same week. A call to the number already held does this in a minute. A reply written inside the thread tells the attacker exactly what the team has noticed and how much time remains.

Evidence is preserved before anybody starts tidying. The original message with its full headers, the payment confirmation, the record of any callback that was made, and a short timeline written the same day while the sequence is still accurate. A report to the national reporting body is made with those attachments. The internal review comes after all of it, and it looks for the gap in the procedure that allowed the request to reach a payment.

09

Rehearsal, and what the procedure costs in practice

A written procedure that has never been performed fails at the moment it is needed. A rehearsal takes fifteen minutes: somebody sends a realistic request from an unexpected address, and the team walks the steps as far as the callback. The usual discovery is a missing telephone number in a supplier record, which costs nothing to fix on a quiet afternoon and costs an invoice to discover on a busy one.

New people meet the procedure in their first week, because this scheme finds the newest member of a finance function with great reliability. Somebody who has been shown the rule once will pause when the message arrives. Somebody who has only heard that the company is careful with money will improvise, and improvisation under time pressure produces the payment the attacker asked for.

The running cost is one minute per change and one line in a record. Set against it is a category that reaches billions of dollars a year in reported losses worldwide and that arrives dressed as an ordinary Tuesday. Ilia Zavialov places a change of payment details in the same class as the keys to an office: a small number of named people hold the right, every handover is written down, and nobody is asked to judge the request on how convincing it feels.