Bank Account Change Fraud: The #1 Attack Vector in 2025

Bank account change fraud now accounts for 42% of all payment fraud attempts. Attackers compromise vendor email accounts, submit fake bank change requests, and reroute payments before anyone notices. Here's how to stop them.

The Anatomy of a Bank Change Attack

The attack follows a predictable pattern that exploits trust and urgency:

1. Reconnaissance — The attacker identifies a target company and its key vendors through public filings, LinkedIn, or compromised email accounts
2. Email compromise — Using phishing or credential stuffing, the attacker gains access to a vendor's email account
3. Change request — The attacker sends a bank account change request from the compromised email, often including forged letterhead and voided checks
4. Urgency pressure — The request emphasizes urgency: "Please update before the next payment cycle"
5. Payout diversion — If the change is processed, subsequent payments flow to the attacker's account

Why Traditional Controls Fail

Most companies rely on one of two manual verification approaches:

Callback verification — The AP team calls the vendor to confirm the change. But if the attacker has compromised the vendor's email, they've likely also changed the callback number in the request.

Manager approval — A supervisor reviews and approves the change. But supervisors rarely have the context or tools to distinguish a legitimate request from a fraudulent one.

Both approaches are slow, inconsistent, and rely on human judgment under time pressure.

A Better Approach: Automated Verification

TrustRelay addresses bank change fraud with a multi-layered verification approach:

Verification Holds

When a bank account change is detected, TrustRelay automatically places a hold on all payouts to the affected vendor. No payments flow until verification is complete.

Ownership Verification

TrustRelay verifies that the new bank account is actually owned by the vendor through:

• Micro-deposit verification — Small test deposits confirm account ownership
• Database checks — Cross-reference account details against banking databases
• Document verification — AI-powered analysis of submitted bank documents

Out-of-Band Confirmation

The system contacts the vendor through a separate, pre-verified communication channel (not the email that submitted the change) to confirm the request is legitimate.

Key Takeaways

• Bank account ownership verification catches 95% of fraudulent change requests
• Verification holds prevent payouts during the validation window
• Out-of-band confirmation (phone, SMS) adds an extra layer of security

Protect Your Organization

Bank account change fraud is preventable with the right controls. The key is automating verification so that every change is checked consistently, without relying on manual processes that attackers can exploit.

Learn how TrustRelay prevents bank change fraud →