Change Of Banking Details Scam

Quick answer: use this route first

Treat every notice of changed banking details as fraudulent until you have confirmed it by voice, on a number you already had. Not the number on the new invoice, not the one in the email signature, and not one from a search. This is among the most expensive frauds per incident in South Africa, because it targets money you were always going to pay, on an invoice you were expecting, to a supplier you genuinely owe. Verified 18 August 2026.

Why this one defeats careful people

Nothing about the transaction is unusual. You are not being offered a bargain, rushed into an investment or contacted out of the blue. You owe the money, the amount is right, the reference is right, and the document looks exactly as it always does, because in most cases it is the real document with one field altered.

• The email account has often been compromised, so the message genuinely comes from the supplier’s address and sits in the correct thread.
• Where the account is not compromised, a lookalike domain is used, differing by an inserted letter or hyphen that reads correctly at a glance.
• The timing is deliberate. The notice arrives when an invoice is genuinely due, which means somebody has been reading the correspondence.
• The explanation is mundane. A bank change, an audit, a switch of accounting system. Nothing that invites suspicion.

The confirmation protocol

1. Phone the supplier on a number you already held, taken from an earlier invoice, a signed contract or their website typed in yourself.
2. Read the new account number to them. Do not ask them to confirm it. Reading it out means that simply agreeing is not enough, and it exposes anyone who cannot recite their own account.
3. Speak to a person you can identify, ideally one you have dealt with before, rather than whoever answers a new number.
4. Send a small test payment first on any large amount, and confirm receipt by phone before releasing the balance.
5. Never confirm by replying to the email. If the account is compromised, the fraudster is answering your reply.

Step five is the one most often missed. Emailing back to check feels like diligence, but it routes the verification through the channel that is already under someone else’s control.

The highest-value targets

• Property transactions. Deposits and transfer costs paid to conveyancing attorneys are large, one-off and paid by people unfamiliar with the process, which makes them a standing target. Confirm attorney trust account details in person or by phone on a number from the firm’s own website, never from an emailed instruction.
• Business supplier payments, especially recurring invoices where the amount is familiar and approval is routine.
• Deposits on vehicles, building work and events, where a single payment is unusually large relative to the buyer’s normal activity.
• Rental deposits, particularly where the landlord or agent has only been dealt with by email.

If you are a business

Make the confirmation step a rule rather than a judgment call, because the person paying invoices is rarely the person who will be blamed.

• Require voice confirmation for every banking detail change, without exception and regardless of who authorises it.
• Keep a maintained list of supplier contact numbers that is not built from incoming email signatures.
• Use dual authorisation for new beneficiaries and for payments above a set amount.
• Turn on multi-factor authentication on email, since the compromise usually starts there rather than in the banking system.
• Tell suppliers how you will verify, so a genuine change is expected to survive a phone call.

Urgent steps if the payment has gone

1. Phone your bank immediately on the number on your card and ask for a recall. This is measured in hours.
2. Tell the real supplier, on a verified number, so they can check whether their email has been compromised and warn other customers.
3. Open a SAPS case on 10111 or at a station and keep the case number.
4. Preserve the emails in original form, with headers, since these show which address actually sent them.
5. Change email passwords and enable multi-factor authentication on both sides if compromise is suspected.

Official reporting routes

Body	Contact	What it handles
Your bank	The number on the back of your card	Recall attempt and dispute, first priority
SAPS	10111, or any station	The criminal case and case number
SAFPS	011 867 2234	Protective Registration if identity details were exposed
National Financial Ombud	0860 800 900	Unresolved bank disputes, after the bank’s process
Legal Practice Council	Its own published channels	Conduct of an attorney, where a trust account is involved

Confirm any regulator’s current contact details on its own website before lodging, and check that your matter falls within its mandate.

What to prepare

• The original and the altered invoice, showing both sets of banking details.
• The full email chain with headers, not forwarded screenshots.
• Proof of payment with the amount, time and beneficiary name and account.
• The supplier’s genuine details as you previously held them.
• The exact sending address, compared character by character with the real one.

If the issue is not resolved

Lodge the dispute with your bank in writing, quoting your SAPS case number and attaching both invoices and the email headers. If the bank’s process is exhausted without resolution, the National Financial Ombud handles unresolved banking disputes subject to jurisdiction, so confirm eligibility before lodging. Expect a difficult question about who bore the risk, since the payment was authorised by you even though it was induced by fraud. The debt to your genuine supplier also usually remains outstanding, and agreeing how that is handled early, in writing, avoids a second dispute later.

Related contact pages

• Company Impersonation Scam South Africa: how the sending identity is assembled.
• Verify Contact Details South Africa: checking domains, emails and banking details.
• Banking Scam Prevention South Africa: the limits and controls that cap a loss.
• Fake Eskom and Municipal Payment SMS Warnings: the utility version of a diverted payment.
• Report A Scam South Africa: the reporting sequence in full.

Frequently asked questions

The email came from my supplier’s real address. How is that possible?

Their email account was probably compromised, which is why the message is genuine in every respect except the banking details. This is exactly why confirmation is done by voice on a number you already had, rather than by replying.

Is a test payment worth the trouble?

On a large amount, yes. A small payment confirmed by phone before the balance is released turns a total loss into a minor one, and costs a day at most.

What information should I prepare?

Both versions of the invoice, the full email chain with headers, proof of payment with beneficiary details, the supplier’s genuine contact details as previously held, and the exact sending address for comparison.

What should I do if I cannot get help?

Escalate the bank dispute in writing with your SAPS case number and full evidence, then approach the National Financial Ombud once the bank’s process is exhausted. Where an attorney’s trust account is involved, the Legal Practice Council handles attorney conduct.

Last verified 18 August 2026. Routes confirmed on saps.gov.za, safps.org.za and nfosa.co.za.