My customer paid the wrong bank account. Was my email hacked?

Phone your bank now, and ask your customer to phone theirs, because money can sometimes be stopped if the banks act fast. Then report it to Report Fraud. Someone's email was probably read by criminals, but it may be your customer's mailbox or a lookalike address rather than yours, so check your own account before assuming either way.

What should we do in the first hour?

Your customer calls their bank. They should use the number on the back of their card or on the bank’s own website, not one from an email. They should say it’s a suspected fraud and ask the bank to try to recall the payment. Every hour counts.
You call your own bank if any of your accounts or payments are involved.
Report it to Report Fraud at reportfraud.police.uk or on 0300 123 2040. Report Fraud replaced Action Fraud. Keep the reference number, because the banks may ask for it.
Don’t delete anything. Keep the fake email, the real invoice and any messages about the payment.

How does this scam work?

It’s usually called invoice fraud, mandate fraud or invoice interception. Criminals get access to an email account, read along quietly, and wait for a real invoice. Then they send an email that looks genuine, often a reply in the real email thread, saying your “bank details have changed” and giving their own account instead (UK Business Forums).

Was it my email that was hacked?

Not necessarily. There are three common possibilities:

Your mailbox was hacked. The criminal read your real invoice and sent the fake one from your account, or from a lookalike address after reading yours.
Your customer’s mailbox was hacked. The criminal saw your genuine invoice arrive and sent the “new bank details” email to their colleague, pretending to be you.
A lookalike address. The fake email came from an address that only looks like yours, such as yourbusiness-uk.co.uk, or “rn” in place of “m”.

To narrow it down:

Compare the addresses. Look at the full sender address on the fake email, not just the display name.
Check your Sent folder for the fake email, and check your mailbox for forwarding rules or filters you didn’t set up. Our guide Someone is sending emails from my address. Have I been hacked or spoofed? shows where to look in Google Workspace and Microsoft 365.
Check your recent sign-ins for anything that wasn’t you.

If you find signs your account was used, follow My business email has been hacked. What do I do? straight away. The criminal may still be reading along.

Will my customer get the money back?

It depends, and it isn’t guaranteed.

The banks may be able to recover some or all of it if they’re told quickly and the money hasn’t been moved on.
Reimbursement rules: for payments made since 7 October 2024, UK banks and payment firms must reimburse victims of authorised push payment (APP) scams sent by Faster Payments or CHAPS, up to £85,000. This covers consumers, micro-enterprises (very small businesses) and charities. Claims must be made within 13 months, the bank can deduct an excess of up to £100, and it can refuse if the payer was grossly negligent (Payment Systems Regulator).
If the bank says no, your customer can complain to the bank, and then to the Financial Ombudsman Service if they’re eligible. In one case, the Ombudsman made a bank refund a director £12,000 lost to an intercepted invoice (Financial Ombudsman Service).

Whether you or your customer bears any loss can depend on whose systems were compromised and what your contract says. If a large sum is involved, get legal advice.

Do I need to tell the ICO?

If your mailbox was hacked and holds personal data (customers’ names, addresses or bank details, for example), it may be a personal data breach. See “Who to tell” below for the 72-hour test.

How do I stop it happening again?

For you:

Turn on two-step sign-in for every email account, so a stolen password isn’t enough.
Set up SPF, DKIM and DMARC on your domain, so criminals can’t easily send email as you. See Why are my emails going to spam or junk?
Put a line on every invoice: “We will never change our bank details by email. If you’re told otherwise, call us on [your number].”
Check your mailbox rules now and then for anything you didn’t set up.

For your customers and suppliers:

Agree that bank detail changes are always confirmed by phone, using a number you already have, never one from the email asking for the change.
Use Confirmation of Payee. When paying a new account, the bank checks whether the account name matches. A “no match” warning is a reason to stop and call.