How do I make sure I am paying the right bank account?

Why the email is genuine-looking and often genuinely from the right address, the one verification step that stops it, and what to do in the minutes after paying the wrong account.

Difficulty: beginner
Time: 12 min
Read: 4 min
Safety: warning

Short answer

Never act on a change of bank details sent by email. Ring the firm on the number from your original engagement letter, an old invoice or their website typed in yourself, and confirm the account details by voice. Do that even when the email is in a thread you have been using for weeks, because the mailbox at one end may be compromised.

Also called mandate fraud or invoice redirection, this is the highest-value fraud most people will ever be exposed to, and it targets exactly two moments: paying a solicitor on a house purchase, and paying a builder a stage payment. Someone reads the email thread, waits for the invoice, and sends a corrected version with different account details.

Safety

This is the fraud that takes house deposits. An email in a real thread, from a real address, saying the bank details have changed, is the single most expensive message a UK household ever receives. Treat any change of payment details, from anyone, as fraudulent until you have confirmed it by voice on a number you already had — never a number in the email.

How a payment is diverted, and the one step that stops it

Step by step

Assume in advance that this will be attempted.Decide before the transaction that you will never act on emailed bank details. This is far more effective than trying to spot the message on the day, because the message is designed to be unremarkable.
Get bank details by voice, at the start, and write them down.Ring the firm on their published switchboard, ask for the account name, sort code and account number, and record them yourself. Some solicitors will give details only in person or by post for exactly this reason.
Verify any change by ringing back on your own number.Not the number in the signature block of the email announcing the change, and not a mobile given in it. The number from your engagement letter, an old invoice, or the firm's website reached by typing the address.
Read the sender address character by character.Lookalike domains are the second mechanism: one letter swapped, a hyphen added, .co.uk changed to .com. In a reply thread they are almost invisible unless you look at the full address.
Send a small test payment first, and confirm it by phone.On a large transfer, send a nominal amount, ring and confirm it landed in the right account, then send the balance. Most conveyancers expect this.
Stop at the confirmation-of-payee warning.UK banks check the account name against the name you type. A "name does not match" warning on a payment to a solicitor or a builder is close to conclusive. Do not click through it.
If you have already paid, ring the bank within minutes.Ring your own bank's fraud line immediately, then the recipient bank if you can, then the firm. Money is sometimes recoverable in the first hour and rarely afterwards. Then Action Fraud, or Police Scotland on 101 in Scotland.
Tell the other party their mailbox may be compromised.If the email came from their real address, their email account is likely to be under someone else's control, and other clients are being targeted at the same time.

Tips

Businesses are hit by the same fraud through changed supplier details. The control is identical: verify a change of bank details by voice, on a number held before the change was requested.
Solicitors' firms increasingly warn clients in writing that they will never change bank details by email. That warning is there because it happens to their clients regularly.
Keep the original engagement letter accessible during the whole transaction. It is the document that contains the number you will need to ring.

Common mistakes

Replying to the email to check — If the mailbox is compromised, the criminal reads and answers the reply. Verification has to leave the channel entirely.
Trusting the thread because your earlier messages are in it — Quoting the previous exchange is trivial when the mailbox is being read, and it is the main reason these messages feel safe.
Assuming a large bank transfer can be reversed later — A push payment leaves immediately and is usually moved on within minutes. Recovery depends on speed above everything.

Questions people ask

Will I be reimbursed if this happens?

House purchase payments are the hardest cases. The UK reimbursement rules for authorised push payment fraud apply to most sterling transfers between UK accounts, but there is a maximum claim limit set by the regulator, and large property payments can exceed it. Ask your bank to raise a claim regardless, and see the reimbursement guide here.

Whose fault is it if the solicitor's email was hacked?

That is exactly what gets argued about, and the answer depends on the facts. Report it to your bank and the firm the same day, get everything in writing, and if the firm's security failed, their professional body and their insurers are relevant.

Does confirmation of payee catch this?

Often, but not always — criminals open accounts in names close to the real firm's, and some account types are outside the scheme. Treat a match as reassuring but not as verification.