Our Banking Information Has Changed!

How it works

A familiar vendor emails new banking instructions and asks you to send your next payment to a different account.

The email often comes from the vendor's real mailbox, which the attacker has been reading for weeks, waiting for a large invoice to be due. The reply-to address is quietly changed so your questions go to the attacker.

Red flags

• A bank change arriving right before a large payment is due
• A new bank in a different state or country from the vendor
• A reply-to address that doesn't match the sender

If it already happened

If you already clicked and signed in: change that password now, from the real site, and turn on multi-factor authentication. If you sent money, call your bank immediately; wire and ACH recalls work best in the first hours. Tell your IT provider so they can check for forwarding rules and other sign-ins on the account.

Where OpenEFA fits

OpenEFA MailGuard blocks most of these before they reach an inbox. The ones that get through are usually the most carefully targeted, which is why your people still need to know the pattern.

Part of the OpenEFA MailGuard Scam Watch series. Published October 21, 2026 by the EFA Security team. Share it freely; a link back is appreciated.