Can my bank get the money back?

Sometimes, if you report it very quickly. Speed matters more than anything.

Does cyber insurance cover this?

It depends on your policy. Many policies have specific terms for social engineering fraud; ask your broker.

How Surrey Businesses Can Stop Fake Invoice and Payment Fraud

How the scam works

An attacker gets into a supplier's or customer's email, usually by stealing a password with a fake login page. They read real conversations, wait for an invoice, then send a convincing message from the real account: "We have changed banks, please use these details." The money goes out, and by the time anyone notices, it is gone.

Who gets targeted

Any business that pays or receives large invoices by email transfer or EFT: trucking and logistics, construction and trades, wholesale, manufacturing, real estate and law offices handling trust funds.

Five controls that stop most of it

Call-back rule. Any change to banking details is confirmed by phone, using a number you already have, never one in the email.
MFA on every email account. Stolen passwords alone stop working.
Email filtering and impersonation protection. Lookalike domains and spoofed senders get flagged or blocked.
Sign-in monitoring. Logins from unusual places trigger alerts so a hacked account is caught early.
Staff training. Short, real examples of what these emails look like.

If it already happened

Call your bank immediately and ask them to try to recall the payment. Then call us at 778-826-0464: we secure the account, check for forwarding rules attackers often add, and document what happened for your insurer and the police report.

Talk to an IT company that answers the phone

Book a free, no-pressure IT assessment. We look at your security, backups, email and phones, then tell you plainly what we would fix. Before you decide, we give you the names and phone numbers of current clients to call.

How to stop fake invoice and payment-change fraud