A supplier sends their usual invoice. This time the message asks you to pay into a new account. The signature looks familiar and the old conversation is still below it. Check the new details before paying anyway.
If you have not paid yet
- Pause the payment. Put the invoice on hold and tell the person responsible for the transfer.
- Call a number you already know. Use the number in your contract or saved contacts. Ask the supplier whether the account changed and confirm the correct IBAN. The number in the suspicious email or a reply to that same email does not give you an independent check.
- Record the confirmation. Note the date and who confirmed the change. If you cannot verify the new details, keep the payment on hold.
If you already paid or entered a password
If you made the transfer, contact your bank straight away. Keep the invoice, email thread and payment details. In Estonia, cyber incidents can be reported to CERT-EE.
If you entered your work email password on a suspicious page or approved an unexpected sign-in on your phone, contact IT support immediately. Tell them which account was involved and when it happened. Enable two-factor authentication to protect accounts. Reject any sign-in prompt you did not initiate.
We can help review your work email security. Get in touch · See small business IT support