PanicStation.org
UK USA
us Money & financial emergencies

What to do if…
a supplier asks you to change payment details to wire or crypto

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy USA guide

Short answer

Pause the payment and verify the change through a trusted contact route you already had for the supplier, not any contact details in the new message. If money has already been sent, contact your financial institution or crypto platform immediately, then file a complaint with IC3.

Do not do these things

  • Do not send a wire, ACH payment, or cryptocurrency payment to new details just because the message mentions late fees, service interruption, or urgency.
  • Do not verify the request using a phone number, link, reply-to address, or attachment from the message that requested the change.
  • Do not rely on the same email thread to verify the request. A compromised mailbox or convincing spoofed thread can look legitimate.
  • Do not approve a new payee, change a payment template, or bypass your normal approval process to move faster.
  • Do not share login codes, MFA prompts, passwords, or banking authentication details with anyone who contacted you first.
  • Do not delete the message, attachments, or payment records. Keep them for your financial institution, security team, and any report you file.

What to do now

  1. Pause the payment internally. Mark the invoice as on hold for payment-detail verification. Notify anyone who can release a wire, ACH payment, or cryptocurrency payment.
  2. Contact the supplier through a trusted route you already had. Use a number from your vendor record, contract, an earlier verified invoice, or a supplier portal you access independently. Do not use details from the new request.
  3. Ask whether the payment details changed. Record who confirmed the change and how you reached them. Do not treat the answer alone as approval to pay.
  4. Use your normal payment-detail change process. Require the usual documentation and approvals before adding a new payee or changing a payment template.
  5. Compare the request with your existing records. Document any difference in the account details, payment method, email address, domain name, invoice format, or contact person. Keep the hold in place until the change has been independently confirmed and approved.
  6. Treat pressure to switch payment methods as a warning sign. A demand for wire or cryptocurrency is especially concerning when it does not match the contract or the supplier’s previous payment method.
  7. Alert your IT or security contact if the request may be fraudulent. Ask them to check for a compromised mailbox, suspicious forwarding rules, unusual login activity, or a lookalike domain. Warn colleagues who might receive a similar request.
  8. If you already sent a wire or ACH payment, contact your financial institution immediately. Tell them the payment may have been induced by fraud. For a wire, ask whether they can request a recall or reversal and contact the receiving financial institution. For an ACH payment, ask what recovery steps may still be available. Record the case number and the time you called.
  9. If you already sent cryptocurrency, contact the platform you used immediately. Tell them the transaction may be fraudulent and ask whether any action is possible. Cryptocurrency payments generally cannot be reversed. Save the destination address, transaction hash, amount, type of cryptocurrency, date, and time.
  10. File a complaint with IC3. Include the payment details, supplier name, invoice, messages, sender addresses, domain names, transaction details, and your financial institution’s case number where available.
  11. Preserve the records. Save the original message, invoice, attachments, payment instructions, payment confirmation, and screenshots that do not expose passwords or authentication codes.

What can wait

  • Deciding who was at fault.
  • Renegotiating supplier terms.
  • Sending demand letters or deciding on legal action.
  • Rewriting your full payment policy. For now, keep the payment on hold and follow your existing approval process.

Important reassurance

Pausing a changed-payment request is a normal safeguard. A convincing message can mislead careful people, especially when it appears to come from a familiar supplier or an existing email thread.

Scope note

These are first steps to pause a potentially irreversible payment and start any available recovery process. Later decisions may need help from your financial institution, security team, insurer, or another appropriate specialist.

Important note

This is general information, not legal, financial, cybersecurity, or other professional advice. Financial institutions and payment platforms have different procedures, and recovery is not guaranteed.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us