Bank Routing Fraud

How Bank Routing Fraud Works

Bank routing fraud is a payment diversion tactic, not a break-in against banking systems themselves. The attacker changes the destination account detail inside an otherwise plausible business payment request, so the victim believes they are paying the correct supplier or counterparty when the funds are actually being redirected.

The scheme is especially effective when it is embedded in invoice fraud, supplier impersonation, or email compromise, because the fraudulent payment instruction arrives in a context the recipient already trusts. The manipulation often targets small but operationally important details, such as sort code, account number, or beneficiary name, where a hurried reviewer may notice the message but miss the altered payee information.

Why It Is Dangerous in Business Payments

The danger lies in timing and trust. Payment workflows are built to move money quickly, and once a transfer is sent to the wrong account, recovery is uncertain and often slow. Because the transaction may still be “successful” from a banking perspective, the fraud can look like a normal payment unless the organisation compares the payment instruction against a verified source of truth.

This makes bank routing fraud particularly harmful in accounts payable, procurement, and treasury processes, where staff may treat an apparently legitimate change request as routine. A single successful diversion can affect cash flow, supplier relationships, and the organisation’s ability to meet obligations on time.

Common Entry Points and Warning Signs

Attackers usually rely on a believable story rather than technical exploitation. A request may claim that a supplier has changed banks, that a new invoice must be paid to a different account, or that a senior executive wants a payment handled urgently. The persuasive element is often urgency, secrecy, or a last-minute change to established payment details.

Warning signs include a request that arrives by email alone, a sudden change in beneficiary data, mismatched contact details, payment instructions that differ from prior correspondence, or pressure to bypass normal approval steps. These signs matter because the fraud depends on interrupting the ordinary verification process.

How Organisations Reduce Exposure

Effective control depends on verifying payment changes through an independent channel, not replying to the same message that introduced the change. Organisations also reduce exposure by maintaining supplier master data controls, using segregation of duties for payment setup and release, and placing holds on unusual or first-time payment runs.

Where invoice and supplier fraud are a material concern, a documented callback process and name-matching checks create friction that is useful, not inefficient. A process that is slightly slower but independently verified is far harder to manipulate than one that relies on the apparent legitimacy of an email thread alone. Invoice Redirection and Supplier Bank Detail Fraud Guide explains the verification controls in more detail, while Online Banking Security Guide covers safer payment and refund practices for banking users.

Risk and Threat Considerations

Bank routing fraud creates direct financial loss risk because the attacker only needs one successful instruction change to divert funds. It also creates control risk, because a weak payment verification process can be exploited repeatedly across suppliers, invoices, or business units. The same social engineering pattern can scale across many organisations because the attacker is abusing a familiar business process rather than attacking a single system.

Failure mechanism: The fraud succeeds when a payment change is accepted as authentic without an out-of-band verification step, allowing a false beneficiary detail to enter the payment chain and override the real one.

Impact: Funds are transferred to the attacker-controlled account, recovery becomes uncertain after settlement, and the organisation may face supplier disruption, financial loss, and internal control scrutiny.

Practitioner Guidance

Why practitioners should care: The key decision is not whether fraud exists, but which payment changes must always be re-verified before release. If that threshold is vague, staff will improvise under pressure and the control will fail at the exact point the attacker is targeting.

Common misunderstanding: A familiar email thread or a known supplier name does not prove that the payment destination is genuine. The account detail is the control point, and it must be verified independently of the message carrying it.

Practitioner takeaway: Treat bank detail changes as a high-risk exception process, not an administrative update, and design the workflow so a single compromised conversation cannot move money on its own.

Related resources from NHI Mgmt Group

• Why do exposed passport and bank details increase downstream fraud risk?
• How should security teams prevent common bank fraud scenarios in digital workflows?
• Who is accountable when bank fraud results from poor data security and access governance?
• Who is accountable when impersonation fraud succeeds in a regulated bank?