The accounts team receives an email from a regular supplier. The sender name, logo and signature look the same as always. It says the company has changed banks and asks you to pay this instalment into the new account, with a revised invoice attached. The company pays as asked. A few weeks later the real supplier phones to chase the money, and only then does the company learn the email did not come from the supplier.
This guide is written for the company that made the transfer and is the victim. It covers what to do immediately, what evidence to keep, whether you still owe the real supplier, and the payment controls to put in place from here on. If the victim is an individual who was tricked into an online transfer, see online scam victims instead.
The short answer
Do three things, in this order. First, notify the bank that sent the money and file a police complaint quickly, because the longer the money sits, the more likely it is to be moved on, although no one can guarantee any of it will be returned. Second, preserve the original evidence, above all the email with its full header and the system logs, before anyone deletes or resets anything. Third, speak to the real supplier through a channel you already know, to agree how the outstanding debt will be handled.
The law. Section 315 of the Civil and Commercial Code requires payment to be made to the creditor or to a person authorised to receive it on the creditor's behalf. Payment to an unauthorised person becomes valid when the creditor ratifies it. Section 316 treats payment made in good faith to a person who appears to be entitled to receive it as valid. So a transfer into the fraudster's account does not, as a general rule, extinguish the debt to the real supplier. But who bears how much of the loss still depends on the contract terms on the receiving account, whose email system was compromised and whether each side took reasonable care to verify.
1. What should the company do in the first hour after finding out?
Work through these in order, and have one person record the time of every step.
- Phone the bank that sent the money. Contact both the corporate account officer and the bank's fraud reporting channel. Give the destination account number, account name, receiving bank, date and time, amount and transaction reference. Ask the bank to contact the receiving bank to hold the funds. If the transfer went abroad, ask for a recall through the interbank transfer network. Note the name of every officer you speak to and every case number you are given.
- Stop every pending payment to that supplier, and freeze edits to vendor bank details in your system. Check whether any other supplier was sent a change-of-account request around the same time.
- Contact the real supplier using the phone number in the contract or the original vendor record. Never use the number or email address in the change-of-account message.
- Do not reply to the fraudster's email, and do not delete anything. Replying alerts the fraudster and prompts them to move the money faster.
- File a complaint with the investigating officer. The company is the victim as a juristic person, so an authorised director must go in person or give a written power of attorney. Prepare the company registration certificate, the power of attorney, ID cards of the authorised director and the attorney, and the evidence listed in section 2. It is acceptable to report online first to get a receipt number sooner, then attend in person to give a statement with the full documents.
- Notify your insurer if you hold a policy that may cover fraud or cyber losses. Policies often set a notice period and conditions for preserving evidence.
- Have IT preserve the system logs first, then close the gaps, for example changing passwords, switching on two-step verification and checking for automatic email-forwarding rules the fraudster may have set up.
Be wary of anyone who offers to "trace the money" and asks for payment in advance with a guaranteed result. No one can guarantee that.
2. What evidence should we keep, and how do we keep it so it is usable?
Good evidence is original material that can be put in time order. Screenshots alone are often not enough.
| Evidence | What it proves | How to preserve it |
|---|---|---|
| The change-of-account email and every email in the thread | The real sender domain, reply-to address and server route | Export as the original email file with the full header; do not use forward |
| Genuine past emails from the supplier | Comparison: a domain spelt one character differently, the same display name with a different address | Export the same way, at least two or three messages |
| The revised invoice and the original | What was altered, such as account number, account name, document format | Keep the original files as received; do not save over them |
| Purchase order, contract and payment terms | The agreed receiving account and the agreed way to notify a change | A copy of the signed version |
| Proof of transfer | Date and time, amount, destination account | Slip, the bank's transfer confirmation, the account statement and, for an overseas transfer, the bank's full transfer message |
| Vendor-record change log | Who changed the account details, when, citing what document | Export the edit history from the accounting system or ERP |
| Payment approval records | Who approved, and whether they saw the account change | Export from the system, or copy the approval document |
| Email login logs | Whether there was access from elsewhere, and whether forwarding rules exist | Request from the email provider quickly, because some log types are deleted on a cycle |
| Internal chats and call records | The order of internal decisions | Export the whole conversation, not just an extract |
Then prepare a one-page timeline in this order: the last genuine invoice, the change-of-account email, the vendor-record edit, the approval, the transfer, the date you found out, the report to the bank and the police complaint. Appoint a single custodian of the evidence, keep the originals, and make separate copies for your lawyer, the police and the insurer.
3. Who requested the account change, and who had authority to approve it?
These two questions set the direction for everything else, both the negotiation with the supplier and the changes to your internal systems.
On the requester's side, a change-of-account email usually comes in one of three forms.
- A look-alike domain, for example spelt one letter differently or using a different domain extension. In this case the supplier's own system may not have been compromised at all; the fraudster got the trading details elsewhere.
- The supplier's genuine email was compromised. The email comes from the supplier's real address, and the fraudster can read the trading thread and picks a moment before a large instalment.
- Your own email was compromised. The fraudster alters the invoice in transit, or sets a rule so that the supplier's emails never reach your staff's inbox.
Each form changes the answer to which side had the better opportunity to prevent the loss, so have an IT specialist read the email headers and the system logs of both sides before drawing conclusions. Also look at who, under the contract, was authorised on the supplier's side to notify a change of receiving account.
On the approval side inside your company, you should be able to answer:
- Who edited the supplier's account details in the system, and on what document?
- Does the company have a written procedure for verifying account changes, and was it skipped?
- Did the person approving the payment see that the destination account had changed?
- Are the person who edits the data, the person who approves and the person who releases the transfer the same person?
Most employees in these cases were deceived in good faith. Blaming the accounts clerk straight away does not help the response and often dries up the flow of internal information. If something suggests an insider was involved, such as repeatedly skipping steps for no reason, run a separate internal investigation following employee embezzlement: internal investigation. For who may approve what, see delegation of authority matrix.
4. Do we still have to pay the real supplier?
The starting point is Section 315. Payment must be made to the creditor or to a person authorised to receive it. The holder of the account the fraudster supplied is neither. So the debt for the goods owed to the real supplier, as a general rule, is not extinguished, unless the supplier ratifies the payment, which in practice almost never happens.
Section 316 applies only narrowly. It protects a person who pays in good faith to "a person who appears to be the holder of the right under the obligation". Whether a fraudster who impersonates the supplier by email falls within that is arguable and depends on the facts. Do not plan on the basis that this section will discharge the debt.
Factors that shift the weight in negotiation
- Contract terms. Does the contract or purchase order name the receiving account, and how does it say a change must be notified, for example in writing signed by an authorised person? Does any term say which side bears the risk?
- Whose system was compromised. If the email came from the supplier's genuine address, or the supplier knew its system was compromised and did not warn customers, the weight differs from a case where your own company was compromised.
- Warning signs that should have been seen. A new account in the name of an individual or a different company, an account abroad although the supplier is a Thai company, urgency or a request for secrecy, or a change announced just before a large instalment.
- Whether the company followed its own procedure. A procedure that was written but not followed weakens your position.
Outcomes seen in practice range from paying in full and then pursuing the fraudster and the insurer, to sharing the loss under an agreement, to paying the outstanding balance in instalments. Whichever route you take, put it in a written agreement that states the amount agreed to be paid, who receives any money later traced, cooperation in the criminal case and a release of the remaining claims.
What you should not do is go silent and withhold payment without replying to the supplier in writing. That can be treated as default, can attract interest, supply being suspended or termination of the contract, and makes negotiation harder.
In the reverse case, where your company is the seller and your customer paid a fraudster, the same principle usually leaves you able to claim payment from the customer. But first check whether your own email was compromised, since that will be the first point the customer raises.
5. How should we deal with the bank, the police and the supplier without expecting too much?
The bank. The sending bank can only pass a request to the receiving bank. Whether funds can be held depends on whether the money is still there and on the receiving bank's legal procedures. For a transfer abroad it also depends on the law of that country. Always ask the bank for its answer in writing.
The criminal case. A complaint opens the way to tracing the money trail and to seizing or freezing assets, but money returning to the company has to go through an order or judgment in the proper process. Appoint a single company coordinator, and keep the case number and the investigating officer's name in the same file as the evidence.
An example from a government agency. The Department of Special Investigation (DSI) published a news release on 10 October 2025 about the arrest of a suspect involved in setting up 30 fake companies to receive payments for goods. According to the release, the victims received fake emails announcing a change of receiving account and transferred payment for goods into the accounts of fake companies in Thailand and Ireland. The reported loss was approximately 3.6 million baht. This example shows the pattern of such an incident; it does not say whether such incidents are becoming more or less frequent today.
The real supplier. Talk through a channel you already know. Propose that both sides check their own email systems, exchange the relevant email headers and prepare a joint record of the facts. Cooperation at this stage often makes the money discussion much easier.
No one can guarantee that the money will be returned, whether the bank, the police or a lawyer. What can be done is to improve the chances with speed and complete evidence, and to limit the remaining loss with a clear agreement.
6. What more should we do if our own email was compromised?
- Assess the personal-data position. A mailbox usually holds personal data of customers, employees and suppliers. Section 37 of the Personal Data Protection Act requires the data controller to notify the Personal Data Protection Committee Office of a breach within 72 hours of becoming aware of it, unless the breach is unlikely to put individuals' rights at risk. The steps are in data breach response: first steps.
- Warn your customers and suppliers that your receiving account has not changed, because a fraudster inside your mailbox may go on to send fake invoices to your customers.
- Preserve logs before fixing anything. Resetting the whole system without first preserving the logs means you cannot show when the fraudster got in or what they saw.
7. What procedure should we have for verifying account changes?
A good procedure does not need to be complicated, but it must be applied every time, with no exception for "urgent" cases.
- Call back to confirm, only to the number in the contract or the original vendor record, never the number in the email or letter requesting the change. Record who called, who they spoke to and when.
- Confirming documents from the supplier. A written notice of the account change signed by an authorised person, with a bank document showing the account name matches the supplier's legal entity. An account in an individual's name, or an overseas account for a domestic supplier, should be treated as a warning sign.
- Segregation of duties. The person who edits vendor data, the person who approves payment and the person who releases the transfer in the bank system should not be the same person, and online banking should be set to require two approvers.
- A cooling-off period. A newly changed account must be fully verified before the first payment. A small test transfer does not help confirm it, because the person who replies that the money arrived may be the fraudster.
- Change reporting. Management should see a monthly list of vendor accounts that were edited.
- Contract terms. State the receiving account in the contract or purchase order, require any account change to be made in writing signed by an authorised person and confirmed by a call-back, and state that notice by email alone does not change the receiving account.
- Warning signs staff must know. Urgency, a request for secrecy, a new contact person, a domain spelt slightly differently, and a change announced just before a large instalment.
- Email systems. Have IT switch on two-step verification, set an alert when a new email-forwarding rule is created, and label emails that come from outside the company.
8. Checklist
When you find out
- Phone the sending bank, and note the officer's name and the case number
- Stop pending payments and edits to the vendor record
- Contact the real supplier on the number in the original contract
- File the police complaint, through an authorised director or an attorney
- Notify the insurer as the policy requires
Evidence
- Export the original emails with full headers, both the fake one and genuine past ones
- Invoices, purchase orders, contract and proof of transfer
- Vendor-record edit history and approval records
- Email login logs, before any password reset
- A one-page timeline and a single custodian of the evidence
With the real supplier
- Read the contract terms on the receiving account and how changes are notified
- Check jointly whose email system was compromised
- Reply to the supplier in writing; do not go silent
- Put the agreement in writing, covering any money traced later
Preventing a repeat
- Call back to confirm every time an account change is requested
- Separate the person who edits the data, the person who approves and the person who releases the transfer
- Put account-change terms in contracts and purchase orders
- Train staff on the warning signs
Read next
- Online scam victims — for victims who are individuals
- Employee embezzlement: internal investigation — when you suspect an insider was involved
- Delegation of authority matrix — who may approve payments and data changes
- Data breach response: first steps — when your company's email has been compromised
- PDPA compliance checklist for businesses — the systems to have in place before an incident
- Debt collection, asset tracing and enforcement — once a judgment has been obtained
- Services: contracts and business documents · legal retainer · PDPA
A transfer into a fraudster's account does not, as a general rule, discharge the debt to the real supplier. What the company can control is how quickly it reports, how complete its evidence is, a written agreement with the supplier and a call-back verification step applied every time.
We help put the evidence and timeline in order, draft letters to the bank and the documents for the police complaint, negotiate and draft the agreement with the real supplier, and write account-change verification steps into your contracts and payment manual. For an initial consultation, call +66 92 254 2045 or send us the details. See also legal retainer.
This guide is published by Suwanvara Law Firm — a Khon Kaen law firm established in 1986. General information only, not legal advice on a specific matter.
