Supplier email hacked: what to do before paying
Pause the affected payment and verify the request through a trusted contact channel separate from email. Preserve original messages, involve your IT team and review other pending instructions. If money has gone, contact your bank immediately. Supplier contact in China can be coordinated with Cambridge China Bridge.
Treat the mailbox as potentially compromised
A genuine sender address and a familiar email thread do not establish that the supplier authorised a bank change. Treat the mailbox as potentially compromised while you investigate. Stop the affected payment and any unverified change to the supplier's payment record; tell finance and procurement why the instruction is on hold.
Our sourcing scam guide covers routine payment-redirection checks. This guide addresses the wider incident: deciding which messages remain trustworthy, preserving evidence and checking whether other instructions have also been altered.
Reach the supplier through a trusted channel
Call a supplier contact using a number held before the suspicious request arrived. Do not use a replacement number, link or contact introduced in that message. Ask whether they sent the request and whether they still control their email account. A reply from the suspect mailbox is not independent confirmation.
If you cannot reach the usual contact, use another previously verified factory contact or an established representative. Agree a temporary communication channel outside the suspect mailbox and record who verified it. Keep payment paused if identity or account details remain unresolved.
Preserve originals and involve your IT team
Keep the original emails, full message headers, attachments and surrounding correspondence. Ask your IT team to preserve them in their original format without opening suspect files. Screenshots can help explain the sequence, but keep the underlying messages too. Record what arrived, what was changed and whether anyone acted on it.
Tell your IT team or external IT provider what happened, including any links opened, files downloaded or credentials entered. Ask them to assess your own accounts as well as the supplier correspondence. Through the trusted channel, ask the supplier to involve its own technical support. Let the technical teams handle account investigation and recovery.
Review other pending instructions
Do not limit the review to the latest invoice. Gather pending payment requests, credit notes, refund instructions, delivery-address changes and requests to release goods or documents received through the suspect account. Compare them with the last independently verified agreement and ask the supplier to confirm discrepancies through the trusted channel.
Use a shared record showing the instruction, affected order, action already taken, person checking it and release decision. Check whether changed details have reached your payment system or forwarder. Our proforma invoice guide helps identify the seller and bank fields to reconcile.
Contact the bank and control the restart
If you have sent a potentially fraudulent payment, contact your bank immediately through its official website or phone number, following NCSC business-payment-fraud guidance. Ask whether it can stop or recall the transfer and provide the payment reference and preserved correspondence. Do not wait for the supplier's investigation or assume recovery is guaranteed.
Before restarting payment, have your authorised finance approver review the independently confirmed payee details, outstanding instructions and technical team's findings. Record the decision and agreed contact route. Our supplier payment guide covers payment arrangements; Cambridge China Bridge's staff in China can help coordinate supplier contact while your team controls payment approval.
Frequently asked questions
Can a bank-change scam come from the real supplier email?
Yes. Treat a genuine address as insufficient proof of authorisation. Verify the request through a previously trusted contact channel outside the suspect mailbox.
Should I reply to ask if the new bank details are genuine?
A reply through the suspect mailbox cannot independently verify the request. Call a previously known number and keep the affected payment on hold.
What evidence should I keep from a suspicious supplier email?
Keep original messages, full headers, attachments, related correspondence and payment records. Ask IT to preserve originals safely; screenshots alone are insufficient for the investigation.
What if I already paid the changed bank account?
Contact your bank immediately using its official contact details and ask about stopping or recalling the transfer. Alert your IT team and preserve the messages. Recovery is not guaranteed.