Quick answer
Payment redirection fraud tricks a business into sending money to a criminal's account, usually through a fake or hacked email saying bank details have changed. Loan settlements, supplier payments and invoice finance are prime targets. Protect yourself by confirming any change of bank details by phone on a number you already hold, using Confirmation of Payee where your bank offers it, and securing every business email account with two-factor authentication.
Key points
- Fraudsters use look-alike, spoofed or hacked email accounts
- Any 'our bank details have changed' message must be verified by phone
- Confirmation of Payee checks the account name against the number before you pay
- Two-factor authentication on email is the single best defence
Most scams try to get you to send money to a stranger. Payment redirection fraud is cleverer: it gets you to send money you were always going to send — to a supplier, a lawyer, a lender — but to the wrong account. Because the payment itself is expected, nobody questions it until the real recipient asks where their money is.
How does payment redirection fraud work?
The National Cyber Security Centre’s Own Your Online service describes three common methods:
- Look-alike email addresses. A domain that is almost right — an extra hyphen, a swapped letter, a different ending.
- Spoofed emails. Messages made to look as if they come from a real organisation’s domain without actually accessing its systems.
- Hacked accounts. Criminals get into a genuine business email account, so the message really does come from the right address, but the bank details are theirs.
The message usually says bank details have changed, and often adds urgency: the payment is overdue, or there will be consequences if it is not made today.
Why is a business loan a target?
Several moments in a loan involve large payments to account numbers:
| Moment | Who pays whom | The risk |
|---|---|---|
| Settlement | Lender or lawyers pay you, or pay creditors | A fake “updated account” for you or a creditor |
| Paying a supplier from loan funds | You pay the supplier | A fake invoice or changed bank details |
| Invoice finance | Your customers pay the provider or you | Customers sent fake bank details |
| Repayments | You pay the lender | A fake “new repayment account” |
Read more about how money moves at online settlement and in online invoice finance.
How do you stop it?
Verify every bank detail change by phone. Use a number you already hold — from the original contract, a previous call or the official website you typed in yourself. Never use a number from the message announcing the change. Own Your Online’s business tips include exactly this: confirm payment changes through a separate channel.
Use Confirmation of Payee. New Zealand banks began rolling out Confirmation of Payee in November 2024, with major banks’ personal online channels expected to have it by Easter 2025. When you enter an account number and name, the system tells you whether they match, partially match or do not match. A mismatch is a reason to stop and call. Our Confirmation of Payee guide explains how to read the results.
Lock down email. Turn on two-factor authentication for every business mailbox, use unique passwords and remove access for former staff. Watch for unexpected forwarding rules — a common sign of a hacked account.
Agree a process in advance. Tell suppliers and customers in writing that you will never change bank details by email alone, and ask them to do the same for you.
Slow down urgency. A legitimate creditor will wait an hour while you check.
Applying soon? Start your enquiry and save your specialist’s number from the first call — it is the number you will use to verify anything later.
What should you do if a payment has gone to the wrong account?
- Call your bank immediately. Ask them to contact the receiving bank. Time matters.
- Report it to the National Cyber Security Centre.
- Check your email security. If your account was compromised, change passwords, remove unknown forwarding rules and enable two-factor authentication.
- Tell the intended recipient and anyone else who may receive fake messages from your account.
- Keep evidence — emails with full headers, payment details and times.
Worked example (illustrative): a Rotorua café owner receives an email that appears to come from her equipment supplier, with a new account number for the $18,000 balance on a coffee machine bought with loan funds. Confirmation of Payee shows “no match”. She calls the supplier on the number on last year’s invoice. The supplier’s email had been hacked; their bank details had not changed.
How will we contact you about bank details?
We will never ask you to change where you send money by email alone. If anything about payments changes, your specialist will tell you on the phone, and you are always welcome to hang up and call back on the number you saved at the start.
How do you check your email has not been compromised?
Signs of a compromised business mailbox include: emails in your sent folder you did not write; contacts receiving messages you never sent; new forwarding rules or filters you did not create; password-reset emails you did not request; and logins from unfamiliar locations in the account’s security activity page. Check these monthly, and immediately if anything feels odd. If you find a problem, change the password from a clean device, sign out all sessions, enable two-factor authentication and remove any rules you did not set up. Then warn your regular contacts that fake messages may have gone out in your name.
Should you put a payment policy in writing?
Yes. A one-page policy for your business — who can approve payments, how bank details are changed, what call-back checks are required — makes it easier for staff to say no to an urgent request. Share a short version with suppliers and customers too, so they know you will never change bank details by email alone, and that they should call if they ever receive such a request.
What about text messages?
Fraudsters use texts as well as email, sometimes appearing in the same thread as genuine messages from a company. Treat a text announcing new bank details exactly like an email: verify by calling a number you already hold.
Start your enquiry, safely
The enquiry takes around a minute, does not involve a credit check and stays with one team rather than circulating among lenders. A real person reads it and becomes your known point of contact for everything that follows. Give accurate details, including where any funds will need to be paid, so payees can be verified early. See if you qualify.
Frequently asked questions
What is Confirmation of Payee?
A service New Zealand banks rolled out from late 2024 that checks whether the account name you enter matches the account number before you pay, showing a match, partial match or no match.
Does Confirmation of Payee stop all fraud?
No. The banking industry has cautioned that it will not fully protect people from scams. It is one useful check alongside calling to verify changes.
What should I do if I paid a fraudulent account?
Call your bank immediately, then report it to the National Cyber Security Centre. Speed gives the best chance of recovering funds.
How do criminals know when a payment is due?
Often by reading emails in a compromised account. They wait for an invoice or settlement and then send a convincing message at the right moment.