“Our bank account has changed” Supplier impersonation affecting Korean businesses

Korean companies lost money after familiar-looking account-change requests

On March 13, 2025, KOTRA's Lisbon office reported trade-payment fraud involving Portuguese bank accounts. Its local tally covered 12 cases affecting Korean companies in 2024 and two through February 2025. Those figures are not a nationwide total for email impersonation.

One company paid after receiving a request from an address differing slightly from its supplier's. Previous legitimate account changes had made the request seem plausible. Another received a request from the usual address and discovered the problem only when the real supplier reported nonpayment; KOTRA described that case as email hacking. A third had traded with its supplier for over five years and uncovered the fraud after being asked to pay again. KOTRA report, March 13, 2025 · Korean ↗

A supplier's history of changing accounts does not authenticate the latest request. What matters is the evidence used to confirm this particular change.

There is more than one way to look like a supplier

This kind of payment deception is commonly called business email compromise, or BEC. Someone impersonates a familiar organization or employee to induce a business action, such as a transfer. Despite the name, not every case requires the victim's mailbox to be compromised; a similar address can also be used. The FBI's explanation of BEC ↗

Mail applications often emphasize the sender's name and give the actual address less space. A matching name does not establish a matching address. Even an exact address match does not prove the message came through the real account. The following distinctions help guide an investigation; they do not assign KOTRA's cases to confirmed technical categories.

You cannot distinguish the second and third rows from the message display alone. An identical address is not enough to conclude that the account was hacked. A mail administrator needs the original and relevant logs. With a similar address, the investigation also depends on exactly which part changed; KOTRA's report does not disclose enough to reconstruct the addresses.

DMARC does not verify who owns the bank account

DMARC checks the From domain: the part after @ in the sender address. SPF or DKIM must pass, and the domain authenticated by that method must align with From. That relationship helps receivers identify unauthorized use of the exact company domain by another server.

An attacker using a separate lookalike domain or a compromised legitimate account can still send mail that passes authentication. DMARC does not validate the employee's name or the bank details in the message. The scope of DMARC protection ↗

Your own DMARC record also does not control every message impersonating a supplier. It states policy for mail using your domain. When supplier mail arrives, their domain's authentication and your receiving service's security decisions are relevant. Keep the authentication result separate from payment approval.

A correct invoice amount does not verify a new bank account

A fraudulent request does not need to get every detail wrong. Accurate order information and a familiar amount can make the remaining details feel trustworthy. The purchase and the destination account are still separate facts.

You may have received the goods and owe exactly the amount shown, yet still have no evidence that the new account belongs to the supplier. Conversely, a valid account does not make an incorrect or duplicate invoice payable.

Two-person approval helps only if the second person can review independent evidence. If Purchasing and Finance read the same email and both assume the supplier sent it, there is still only one source. The second reviewer needs to see who was contacted, how that contact was obtained, and what was confirmed.

Check where the “existing contact” came from

Use a number in a contract or supplier record that was verified before this request arrived. A number in the new email signature, an attached letter, or a reply to the suspicious message is not independent. The person making the request could control that verification route too.

If the established contact has left or the number has changed, verify the replacement contact first. A previously verified company switchboard may help you reach the correct department and confirm who has authority. Keep the account change on hold while that remains unresolved. Explain the delay to the business owner and coordinate deadlines across time zones without turning a missing confirmation into approval.

Work through one request from receipt to decision

1. Log the request and leave the current payee details unchanged

The Purchasing officer does not overwrite the supplier's registered account on receipt of the email. They record the existing and proposed details side by side and mark the payment “Account change pending verification.” Finance is told why it is on hold and checks that neither a scheduled transfer nor another employee's manual payment will proceed.

Connect the account-change review to the invoice already in the approval process. Check the purchase order, invoice identifier, and payment status so a resubmitted invoice cannot produce a duplicate while the request is being investigated. Urgency should trigger a faster verification effort, not payment before verification.

2. Confirm the request through a separately established contact

The officer calls the supplier number already in the company's vendor records, rather than the number in the email. Once connected to the established contact, they ask whether the bank account for this order has changed. If the answer is yes, they compare the beneficiary name, bank name and country, complete account number or IBAN, and effective date.

An IBAN is an international bank account number used in some countries. A plausible format or official-looking letter does not confirm ownership. The point is to establish that an independently verified supplier contact confirms these payment details. Compare the full number, while limiting access to the internal record to people who need it for payment handling.

In this example, the established contact denies requesting a change. Gaon rejects the new account and stops the payment. It alerts the supplier to the suspicious message and confirms the genuine invoice and payment plan through the independent channel. Merely restoring the old number and immediately paying would leave the surrounding request unexamined.

3. Leave enough detail for the approver to review

“Verified by phone” does not tell the next person what was established. Record the request, the source of the contact details, the person reached, and the answer. A shortened Gaon record might look like this:

Payment: US$20,000 invoice against an existing purchase order
Request: use a different bank account for this payment
Contact source: supplier register maintained before the request
Person reached: established supplier contact
Question checked: whether the bank-account change was authorized
Result: supplier denied requesting any change
Decision: reject new payee details; hold the related payment
Follow-up: Finance checks payment status; IT preserves and investigates the original

In the real record, include the time, staff member, number called, and location of supporting documents. The approver checks whether the contact was independent of the new email, whether that person could authorize a change, and whether the result matches the final payment details. In a small organization that cannot fully separate these duties, assign another responsible person to review the evidence.

4. Distinguish rejection, a continuing hold, and approval review

The last row is not automatic approval after one phone call. Compare the confirmed beneficiary with the account actually entered, then check the invoice amount, deadline, and duplicate-payment status. Record who approved the account change so future payments have a traceable basis for using it.

The FBI recommends independently confirming payment-detail changes and avoiding contact details supplied by the suspicious request. The workflow above puts that principle into records and decisions that Purchasing and Finance can use. FBI prevention guidance ↗

If money has already been sent, contact the bank before the investigation is complete

If a transfer appears fraudulent, notify your bank immediately and ask about available stop-payment, recall, or recovery procedures. Prepare the transfer time, amount and currency, transaction reference, beneficiary bank, and account details, and report the incident to law enforcement. What can be recovered depends on where the funds have moved and the actions available to the institutions involved. The FBI's advice to contact the financial institution immediately ↗

Hold further requests and related payments that have not yet executed. Assign separate owners for the bank, supplier contact, and email investigation so each can proceed. Verify any later approach demanding a new fee or another transfer to “recover” the funds through established channels.

Finance preserves the payment trail; IT preserves the message

Keep the original email with full headers, attachments, conversation history, and transfer records, as well as screenshots. Headers help establish the route and authentication results. Ordinary forwarding may omit useful evidence, so use the service's original-message download or ask an administrator to preserve it. Collecting evidence should run alongside the bank contact, not delay it.

If account compromise is suspected, administrators should examine sign-ins, forwarding and inbox rules, sent messages, and connected-app permissions. Confirmed compromise calls for addressing sessions and access permissions as well as restoring secure authentication. A password change alone does not complete the investigation. Follow the incident-response procedure for the mail service in use. Microsoft's compromised-account response guidance ↗

To reduce unauthorized use of your own domain, maintain a sender inventory and verify SPF, DKIM, and DMARC. For payments to suppliers, keep independently verified contacts and a record of account changes. When the next request arrives, the employee needs a reliable person to contact and a clear way to hold the payment while checking it.