The Bank Details Had Changed. Except They Hadn't: A Yorkshire Café, a £3,000 Email and Three Checks Every Micro-Firm Should Copy

The email arrived on a Thursday and it looked like housekeeping. Same thread, same signature block, same reference number as the quote the café had been chasing for a fortnight. All it said was that the supplier had moved banks, could future payments please go to the account below, and sorry for the faff.

To be clear about what follows: this is a composite. The café is a five-person operation in the Calder Valley, the names have been changed, and the sequence of events has been assembled from the pattern that fraud teams see week in, week out across Yorkshire and beyond. Everything in it is entirely ordinary. That's the point.

The setup: a grinder, a quote and a payment that was already late

The Loom Room, a café doing decent trade on a Hebden Bridge side street, had ordered a commercial coffee grinder from Northern Grind, a small equipment supplier in West Yorkshire. Invoice NG-4471. Just under £3,000 including VAT, with a 30% deposit already paid in the spring.

Bev, who owns the place, handles supplier relationships. Aisha does the books two mornings a week. Neither of them is naive — Aisha had set up dual authorisation on the banking app after a friend got caught by a card scam — but they were running a café in the middle of a busy half-term, one member of staff down, and nobody had slept properly since the boiler went.

That's the environment these scams are built for. Not stupidity. Volume of work.

What actually happened

The email came from a display name reading "Northern Grind Accounts". The address behind it was [email protected] — one word different from the genuine northerngrind.co.uk. It had been registered three weeks earlier. The reply-to was set to a free webmail address.

Because the scammer had the genuine quote attached and referenced the right invoice number, the message landed in the existing thread and looked like a continuation rather than a new instruction. Bev did the sensible thing and rang the number in the signature block. A man answered, said he was covering for a colleague, confirmed the change, and apologised for the inconvenience. The number belonged to a VoIP service costing about £4 a month.

At 4:50 on Friday afternoon, Aisha keyed in the payment. The bank's Confirmation of Payee check came back with a partial match — the account name didn't line up with Northern Grind Ltd. She queried it with Bev, who relayed the phone call. They approved it anyway, because the man on the phone had been convincing and the supplier was already chasing.

On Monday morning, the real Northern Grind rang about the invoice.

The recovery, and why it was only partial

The bank moved fast. Roughly £1,850 of the £3,000 was recalled from the receiving account before it was emptied. The rest is gone, and it went through because the customer had overridden an explicit warning — which is precisely the scenario where you should not assume you'll be made whole. Action Fraud was notified. The café's insurance covered some of the gap. Bev spent two weeks rewriting payment procedures and three months being politely furious with herself.

Check one: verify money out loud, using a number you already had

The single most effective control in the whole story is embarrassingly simple. Any change to bank details is verified by phone, using a number from a previous invoice, your own supplier records, or the supplier's website typed in by hand — never a number in the email that told you about the change.

If a supplier genuinely has changed banks, they will not mind the phone call. Scammers cannot survive it, because they cannot answer a number they don't control.

Then use Confirmation of Payee properly. Read the result. If it says no match or partial match, stop. "Partial" usually means a name that differs by a word — often because it's a mule account, not because the supplier rebranded.

Check two: stop other people impersonating your own domain

If your firm sends invoices, you are a target for exactly this trick played in reverse. Three DNS records do most of the work:

• SPF lists who is allowed to send email as your domain.
• DKIM signs your outgoing mail so tampering is detectable.
• DMARC tells receiving servers what to do when either fails. Start at a monitoring policy, then move to quarantine and reject once you've checked nothing legitimate breaks.

The NCSC runs a free Mail Check tool for exactly this, and it takes about fifteen minutes if your domain is simple. Turn on two-factor authentication for every mailbox, and use a proper business email service rather than a personal one.

One honest caveat: authentication does not help if the attacker is sitting inside the supplier's real mailbox. Which is why check one still exists.

Check three: build a pause into anything that moves money

Fraudsters eat urgency. So make urgency structurally useless.

Set a rule, in writing, that no bank-detail change is actioned the same day, and that any new payee over a set threshold needs two people. If you're a two-person firm, that means one person prepares and the other confirms by phone — even if you're married, even if it feels daft. Add the rule to your invoices and to the footer of your emails so suppliers know you'll ring.

Aisha's dual authorisation was already in place; it just needed a rule behind it that said "no override." That's the difference between a control and a formality.

If it happens anyway

Ring your bank immediately — the first hours matter more than anything else. Report to Action Fraud on 0300 123 2040 or via the online portal. Tell your supplier, because their inbox or their systems may be compromised too. And if personal data has been exposed, the ICO's 72-hour reporting clock may apply.

The ten-minute version

Print it, stick it by the till:

1. Bank details change? Phone a number you already had. Never the one in the email.
2. Read the Confirmation of Payee result out loud. A partial match is a red light.
3. SPF, DKIM, DMARC set up and monitored. 2FA on every mailbox.
4. Two people, one phone call, no same-day changes.

None of that requires a budget. All of it requires five minutes of stubbornness at the exact moment you're busiest — which is, unfortunately, the whole job.