--- id: CP-356 slug: callback-verification-known-number-bank-details-change lang: en title: Call-back check before a bank details change description: "A supplier or an executive demands new bank details or an urgent transfer: call them back on a number you already have, then get the request approved." canonical_url: https://startbrain.io/cyberpedia/en/articles/callback-verification-known-number-bank-details-change/ markdown_url: https://startbrain.io/cyberpedia/en/articles/callback-verification-known-number-bank-details-change.md publisher: Brain (https://startbrain.io) license: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) cite_as: Brain, "Call-back check before a bank details change", Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/callback-verification-known-number-bank-details-change/ (CC BY 4.0) wing: 5 theme: handle_scams reflex: cr-080 schema: G5 updated: "2026-11-03" translations: en: https://startbrain.io/cyberpedia/en/articles/callback-verification-known-number-bank-details-change/ fr: https://startbrain.io/cyberpedia/fr/articles/contre-appel-numero-connu-changement-rib/ de: https://startbrain.io/cyberpedia/de/articles/rueckruf-bekannte-nummer-aenderung-bankverbindung/ es: https://startbrain.io/cyberpedia/es/articles/contrallamada-numero-conocido-cambio-datos-bancarios/ sources: - "n": 1 title: Que faire en cas de phishing ou hameçonnage ? - Assistance aux victimes de cybermalveillance publisher: Cybermalveillance.gouv.fr url: https://www.cybermalveillance.gouv.fr/tous-nos-contenus/fiches-reflexes/hameconnage-phishing published: "2020-01-10" accessed: "2026-11-03" - "n": 2 title: Recognize and Report Phishing | CISA publisher: CISA url: https://www.cisa.gov/secure-our-world/recognize-and-report-phishing accessed: "2026-11-03" - "n": 3 title: Avoiding Social Engineering and Phishing Attacks | CISA publisher: CISA url: https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks published: "2021-02-01" accessed: "2026-11-03" - "n": 4 title: Phishing for Information, Technique T1598 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1598/ accessed: "2026-11-03" - "n": 5 title: "Compromise Accounts: Email Accounts, Sub-technique T1586.002 - Enterprise | MITRE ATT&CK®" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1586/002/ accessed: "2026-11-03" - "n": 6 title: "Email Collection: Email Forwarding Rule, Sub-technique T1114.003 - Enterprise | MITRE ATT&CK®" publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1114/003/ accessed: "2026-11-03" - "n": 7 title: Internal Spearphishing, Technique T1534 - Enterprise | MITRE ATT&CK® publisher: MITRE ATT&CK url: https://attack.mitre.org/techniques/T1534/ accessed: "2026-11-03" --- # Call-back check before a bank details change A message asks to change a supplier's bank details (RIB), or to make a transfer right away for an executive. If the sender is a scammer, the employee who carries out the request pays in their place. In both cases, the author poses as a trusted third party, the pattern that Cybermalveillance.gouv.fr describes for phishing: tricking the victim to obtain banking or personal data [1]. CISA advises against calling the number in the suspicious message and recommends reaching the company or the person by another means [2]. This page explains why this step works and which traps get around it. ## In 30 seconds - Where it happens: through a fake message, SMS or phone call that imitates a trusted third party [1]. - What the attacker wants: to obtain banking or personal data by posing as a trusted third party [1]. - The reflex: click on nothing and call no number shown in the message, find another way to reach the person [2]. - If it is already done: immediately warn the relevant people in the organization and the financial institution [3]. ## Straight answers ### What is a fraudulent bank details change request? It is a request that seems to come from a supplier or an executive and aims to change bank details or to trigger an urgent transfer. The sources cited here do not cover this case by name: they describe phishing in general. According to Cybermalveillance.gouv.fr, it is a fake message, SMS or phone call, presented as coming from a trusted third party, to obtain personal or banking data [1]. The aim is to use that data fraudulently [1]. ### Why call back on a number already on file? Because the contact details in the message are the ones the scammer chose. CISA asks people to click on no link and to call no number shown in the suspicious message, and to reach the company or the person by another means [2]. It advises taking the contact details from a verified site, or contacting the person through another channel to find out whether they really wrote [2]. A second CISA text points the same way: when in doubt, contact the company directly, without using the contact details of a site linked to the request, and by looking for those in earlier documents (statements, letters) [3]. ### Why is the request always urgent? Urgency is a warning sign. CISA lists among common signs urgent or emotionally charged language, in particular messages that announce serious consequences if there is no immediate reply [2]. MITRE notes that phishing meant to collect information often goes through several messages that look urgent [4]. ### Is an email from the right address reliable? No. MITRE describes attackers who compromise email accounts to then use them for phishing [5]. An account already known to the victim can create trust, and the attacker can hijack existing exchanges [5]. The displayed address therefore does not prove that the author is the real account holder. ### What if the payment has already gone out? Warn people without delay. CISA recommends reporting any sensitive information disclosed to the right person in the organization, including network administrators, and contacting the financial institution immediately if accounts may be compromised [3]. Cybermalveillance.gouv.fr adds to keep the evidence, in particular the message received, and to file a complaint in case of fraudulent debits [1]. ## How it works The call-back rests on a simple principle: the scammer controls the message, not the file. The number on record before the request was not supplied by the author of the message. CISA also recommends not using the contact details of a page linked to the request, but looking for those in earlier documents [3]. A sender's identity can be imitated: MITRE cites spoofing of the sender's identity, which can fool the recipient as well as automated security tools [4]. CISA adds that addresses often imitate those of a real company, by changing or omitting a few characters [3]. ## What you do The steps below rely on the verification guidance in the sources cited here. Approval by a second person does not appear in them: it is an internal procedure rule, to be set by the company. - Do not reply to the message and do not click on any link or attachment in the request [2]. - Look for the requester's contact details in earlier documents, not on a site linked to the request [3]. - Contact the company or the person directly to check the request [3], before any change of bank details or any transfer. - Have the request approved by a designated second person before carrying out the operation. - If you cannot reach the requester, do not pay and do not change anything. Report the request internally. - Keep the message received: Cybermalveillance.gouv.fr insists on keeping evidence [1]. ## Pitfalls ### Urgency and confidentiality A request that pressures you or forbids you to talk about it prevents the call-back and the second approval. CISA lists urgency among the signs to recognize [2]. The sources cited here do not describe the confidentiality demand: it is to be treated as one more reason to check. ### The spoofed or hacked email An address almost identical to the real one is a classic sign: CISA gives the example of an address like amazan.com [2]. But an exact address is not enough, because a hacked account can be used to write to its holder's contacts [5]. The sources cited here give no reason to trust the email alone. ### The hidden forwarding rule An attacker who has taken over an account can watch the mailbox without being seen. MITRE describes email forwarding rules, which serve to follow the victim's activity and to steal information [6]. These rules can keep access to messages even after a credential reset, and can be hidden in some tools [6]. An exchange that looks normal can therefore be watched, or even hijacked. ### The request from inside A message from a colleague or an executive is not necessarily safe. MITRE describes internal phishing, where compromised accounts target other members of the organization, and cites a group that targeted executives, human resources and IT [7]. Accounting is not named there, but the principle is the same: belonging to the company does not replace verification. ### The fake invoice The sources cited here do not describe the fake invoice as such. A CISA text warns against unsolicited attachments [3]. CISA lists requests for personal and financial information [2]. An invoice accompanied by new bank details falls under this warning: the call-back applies in the same way. ## Sources 1. Cybermalveillance.gouv.fr, "Que faire en cas de phishing ou hameçonnage ? - Assistance aux victimes de cybermalveillance", 10 January 2020. https://www.cybermalveillance.gouv.fr/tous-nos-contenus/fiches-reflexes/hameconnage-phishing (accessed 3 November 2026) 2. CISA, "Recognize and Report Phishing | CISA". https://www.cisa.gov/secure-our-world/recognize-and-report-phishing (accessed 3 November 2026) 3. CISA, "Avoiding Social Engineering and Phishing Attacks | CISA", 1 February 2021. https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks (accessed 3 November 2026) 4. MITRE ATT&CK, "Phishing for Information, Technique T1598 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1598/ (accessed 3 November 2026) 5. MITRE ATT&CK, "Compromise Accounts: Email Accounts, Sub-technique T1586.002 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1586/002/ (accessed 3 November 2026) 6. MITRE ATT&CK, "Email Collection: Email Forwarding Rule, Sub-technique T1114.003 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1114/003/ (accessed 3 November 2026) 7. MITRE ATT&CK, "Internal Spearphishing, Technique T1534 - Enterprise | MITRE ATT&CK®". https://attack.mitre.org/techniques/T1534/ (accessed 3 November 2026) --- Original source: Cyberpedia, the public cybersecurity and AI encyclopedia published by Brain. Canonical version: https://startbrain.io/cyberpedia/en/articles/callback-verification-known-number-bank-details-change/ You may reuse this text freely under the CC BY 4.0 license (https://creativecommons.org/licenses/by/4.0/), provided you credit "Brain, Cyberpedia" with a link to the canonical URL above.