Cyberpediaby Brain
ENDEFR

Call-back check before a bank details change

A supplier or an executive demands new bank details or an urgent transfer: call them back on a number you already have, then get the request approved.

In 30 seconds

Where it happens
Through a fake message, SMS or phone call that imitates a trusted third party1.
What the attacker wants
To obtain banking or personal data by posing as a trusted third party1.
The reflex
Click on nothing and call no number shown in the message, find another way to reach the person2.
If it is already done
Immediately warn the relevant people in the organization and the financial institution3.

What it is

A message asks to change a supplier's bank details (RIB), or to make a transfer right away for an executive. If the sender is a scammer, the employee who carries out the request pays in their place. In both cases, the author poses as a trusted third party, the pattern that Cybermalveillance.gouv.fr describes for phishing: tricking the victim to obtain banking or personal data1.

CISA advises against calling the number in the suspicious message and recommends reaching the company or the person by another means2. This page explains why this step works and which traps get around it.

Straight answers

What is a fraudulent bank details change request?

It is a request that seems to come from a supplier or an executive and aims to change bank details or to trigger an urgent transfer. The sources cited here do not cover this case by name: they describe phishing in general. According to Cybermalveillance.gouv.fr, it is a fake message, SMS or phone call, presented as coming from a trusted third party, to obtain personal or banking data1. The aim is to use that data fraudulently1.

Why call back on a number already on file?

Because the contact details in the message are the ones the scammer chose. CISA asks people to click on no link and to call no number shown in the suspicious message, and to reach the company or the person by another means2. It advises taking the contact details from a verified site, or contacting the person through another channel to find out whether they really wrote2.

A second CISA text points the same way: when in doubt, contact the company directly, without using the contact details of a site linked to the request, and by looking for those in earlier documents (statements, letters)3.

Why is the request always urgent?

Urgency is a warning sign. CISA lists among common signs urgent or emotionally charged language, in particular messages that announce serious consequences if there is no immediate reply2. MITRE notes that phishing meant to collect information often goes through several messages that look urgent4.

Is an email from the right address reliable?

No. MITRE describes attackers who compromise email accounts to then use them for phishing5. An account already known to the victim can create trust, and the attacker can hijack existing exchanges5. The displayed address therefore does not prove that the author is the real account holder.

What if the payment has already gone out?

Warn people without delay. CISA recommends reporting any sensitive information disclosed to the right person in the organization, including network administrators, and contacting the financial institution immediately if accounts may be compromised3. Cybermalveillance.gouv.fr adds to keep the evidence, in particular the message received, and to file a complaint in case of fraudulent debits1.

1How it works1 min

The call-back rests on a simple principle: the scammer controls the message, not the file. The number on record before the request was not supplied by the author of the message. CISA also recommends not using the contact details of a page linked to the request, but looking for those in earlier documents3.

A sender's identity can be imitated: MITRE cites spoofing of the sender's identity, which can fool the recipient as well as automated security tools4. CISA adds that addresses often imitate those of a real company, by changing or omitting a few characters3.

2What you do1 min

The steps below rely on the verification guidance in the sources cited here. Approval by a second person does not appear in them: it is an internal procedure rule, to be set by the company.

  • Do not reply to the message and do not click on any link or attachment in the request2.
  • Look for the requester's contact details in earlier documents, not on a site linked to the request3.
  • Contact the company or the person directly to check the request3, before any change of bank details or any transfer.
  • Have the request approved by a designated second person before carrying out the operation.
  • If you cannot reach the requester, do not pay and do not change anything. Report the request internally.
  • Keep the message received: Cybermalveillance.gouv.fr insists on keeping evidence1.
3Pitfalls2 min

Urgency and confidentiality

A request that pressures you or forbids you to talk about it prevents the call-back and the second approval. CISA lists urgency among the signs to recognize2. The sources cited here do not describe the confidentiality demand: it is to be treated as one more reason to check.

The spoofed or hacked email

An address almost identical to the real one is a classic sign: CISA gives the example of an address like amazan.com2. But an exact address is not enough, because a hacked account can be used to write to its holder's contacts5. The sources cited here give no reason to trust the email alone.

The hidden forwarding rule

An attacker who has taken over an account can watch the mailbox without being seen. MITRE describes email forwarding rules, which serve to follow the victim's activity and to steal information6. These rules can keep access to messages even after a credential reset, and can be hidden in some tools6. An exchange that looks normal can therefore be watched, or even hijacked.

The request from inside

A message from a colleague or an executive is not necessarily safe. MITRE describes internal phishing, where compromised accounts target other members of the organization, and cites a group that targeted executives, human resources and IT7. Accounting is not named there, but the principle is the same: belonging to the company does not replace verification.

The fake invoice

The sources cited here do not describe the fake invoice as such. A CISA text warns against unsolicited attachments3. CISA lists requests for personal and financial information2. An invoice accompanied by new bank details falls under this warning: the call-back applies in the same way.

Fact sheet

Identifier
CP-356
Wing
5. Office life and reflexes
Brain skill
Foiling Scams (handle_scams)
Brain reflex
cr-080
Diagram
G5 · Employee Decision Tree
Languages
de, en, fr
Sources
7 sources checked on 3 November 2026
Sources7 sources
  1. Cybermalveillance.gouv.fr, “Que faire en cas de phishing ou hameçonnage ? - Assistance aux victimes de cybermalveillance”, 10 January 2020. https://www.cybermalveillance.gouv.fr/tous-nos-contenus/fiches-reflexes/hameconnage-phishing (accessed 3 November 2026)
  2. CISA, “Recognize and Report Phishing | CISA”. https://www.cisa.gov/secure-our-world/recognize-and-report-phishing (accessed 3 November 2026)
  3. CISA, “Avoiding Social Engineering and Phishing Attacks | CISA”, 1 February 2021. https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks (accessed 3 November 2026)
  4. MITRE ATT&CK, “Phishing for Information, Technique T1598 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1598/ (accessed 3 November 2026)
  5. MITRE ATT&CK, “Compromise Accounts: Email Accounts, Sub-technique T1586.002 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1586/002/ (accessed 3 November 2026)
  6. MITRE ATT&CK, “Email Collection: Email Forwarding Rule, Sub-technique T1114.003 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1114/003/ (accessed 3 November 2026)
  7. MITRE ATT&CK, “Internal Spearphishing, Technique T1534 - Enterprise | MITRE ATT&CK®”. https://attack.mitre.org/techniques/T1534/ (accessed 3 November 2026)

Cite this article

Brain, “Call-back check before a bank details change”, Cyberpedia, 2026. https://startbrain.io/cyberpedia/en/articles/callback-verification-known-number-bank-details-change/

BibTeX 
@misc{brain_cp356_en_2026,
  author = {Brain},
  title = {Call-back check before a bank details change},
  year = {2026},
  howpublished = {Cyberpedia},
  url = {https://startbrain.io/cyberpedia/en/articles/callback-verification-known-number-bank-details-change/},
  note = {CC BY 4.0}
}
CC BY 4.0 licence