Supplier bank details changed by email: organising a Saudi company’s response

Checked: 2026-10-12

The practical question

A familiar-looking email asks you to pay a supplier into a new account. What should be verified before approval?

Businesses using email for payment instructions, whether the request is identified before or after payment.

Treat the underlying debt and the requested bank account as separate questions. A genuine invoice may carry false payment instructions. If payment has occurred, an authorised representative can promptly ask the bank through its established channel about available assistance, without assuming funds can be stopped or recovered. Technical staff should preserve original records within their authority. A forwarded message may omit useful data, and use of an employee’s mailbox does not itself attribute the act to that employee.

Alternative explanations

A genuine banking change, a copying error or an unauthorised instruction without a compromise; appearance alone cannot establish origin.

Legal basis and verification limits

Article 4(1) of the Anti-Cyber Crime Law addresses obtaining property through fraud, a false name or assumed capacity. The Anti-Financial Fraud and Breach of Trust Law also requires assessment against the facts. An email alone establishes neither the taking nor the actor’s identity.

• نظام مكافحة جرائم المعلوماتية: https://www.mof.gov.sa/docslibrary/RegulationsInstructions/DocLib/نظام%20مكافحة%20جرائم%20المعلوماتية.pdf
• نظام مكافحة الاحتيال المالي وخيانة الأمانة: https://www.uqn.gov.sa/details?p=17528

Review questions

• Has payment been made or is approval pending?
• Did an authorised person verify through a previously established independent channel?
• Are there technical indicators requiring specialist examination?

Relevant records

• Original email, headers and attachments preserved unchanged
• Beneficiary-change history and approval trail
• Invoice, payment order, execution time and verification contacts

Hypothetical example

Hypothetical example: a genuine invoice is followed by a message changing the account. A call through an existing verified channel contradicts the change. That verifies the instruction issue; identifying who created the message requires separate work.

A proposed preventive control

Does a beneficiary change require independent verification and recorded approval before payment?

Questionnaire options: Yes, Partly, No, Unknown, Not applicable. Unknown triggers verification; Not applicable needs an applicability reason. Neither is treated as a missing control.

When professional help is useful

To request a paid legal consultation, begin with a brief non-confidential description. Identifying the parties, checking conflicts and agreeing scope and fees come before work. The consultation includes an initial review of documents within an agreed scope, a meeting to discuss the facts and questions, and a concise written summary of options, missing information and the next step in the agreed language. Internal investigations, settlement, complaints and representation are separate engagements when needed. Company representation and individual defence are separate paths subject to position and conflicts.

References

• نظام مكافحة جرائم المعلوماتية: https://www.mof.gov.sa/docslibrary/RegulationsInstructions/DocLib/نظام%20مكافحة%20جرائم%20المعلوماتية.pdf
• نظام مكافحة الاحتيال المالي وخيانة الأمانة: https://www.uqn.gov.sa/details?p=17528

Related legal service · Existing tool