The Builder's New Bank Details

The simulator

1. Step 1 of 6 First contact

   An email arrives from Dan with the invoice for the deposit. You’ve been expecting it.

   Inbox

   Invoice 2291: deposit for your kitchen

   Dan Russo, Harbor Line Renovations <[email protected]>

   To: me

   Hi,

   Thanks again for your time last week. The cabinets are ordered and we’re all set to start on Monday the 14th.

   Attached is invoice 2291 for the 40% deposit: $14,800. Our bank details are on the invoice.

   Any questions, just give me a call.

   Dan Russo Harbor Line Renovations

   Read this aloud

   What do you do?

   Not sure? Show a hint

   Everything looks normal. But how would you know if someone else could read Dan’s emails?

   1. Pay it now, using the bank details on the invoice. It’s from Dan’s usual email address.

      Better, but not the safest

      This time the details are probably Dan’s. But you can’t tell from an email alone, because criminals who break into a builder’s email can send invoices from the real address. For a large payment, a quick call first is worth it.

   2. Reply to the email and ask Dan to confirm the bank details.

      Risky choice

      It feels like a check, but it isn’t one. If someone else is reading Dan’s emails, they’ll see your question and happily confirm whatever details they like. A reply stays inside the same email conversation, so it can’t prove anything.

   3. Before paying, call Dan on the number on his business card and read the bank details back to him.

      Safe choice

      That’s the habit that stops this scam. A number Dan gave you in person can’t be changed by anyone who gets into his email. It takes two minutes, and Dan won’t mind.

   Red flags at this step

   • A large bank transfer to an account you haven’t paid before
   • Bank details that arrive only by email

   What's really going on

   Criminals don’t need to fake the first email. They often get into a builder’s, lawyer’s or real estate agent’s email account, or yours, and quietly read the real conversation, waiting for a payment to come up. UK Finance says they typically target people by posing as solicitors or builders, and that this fraud “often involves the criminal either intercepting emails or compromising an email account.”

2. Step 2 of 6 The hook

   Whatever you decided, an hour later a second email arrives in the same conversation.

   Inbox

   RE: Invoice 2291: deposit for your kitchen

   Dan Russo, Harbor Line Renovations <[email protected]>

   To: me

   Dan's first email came from [email protected]

   Hi again,

   Sorry, one quick thing before you pay. We’ve changed banks, and our old account is being audited this month, so please don’t use the details on the invoice. Please use our new account instead:

   Account name: Harbor Line Renovations Bank: Coastal Trust Bank Account and routing numbers: on the updated invoice attached

   Please pay today if you can. If the deposit isn’t in by 5 pm, we may lose your start date, as the crew is booked on another job after that.

   I’m on site all day, but you can reach our new office line on (617) 555-0162.

   Thanks, Dan

   Read this aloud

   What do you do?

   Not sure? Show a hint

   Compare the sender’s address with the note above it, letter by letter.

   1. Pay the new account today. It’s the same conversation, it’s signed by Dan, and I don’t want to lose my start date.

      Risky choice

      This is the moment the money is lost. The account belongs to the criminals, and a bank transfer is very hard to get back once it has gone. The 5 pm deadline is there to stop you checking.

   2. Send a small amount to the new account first, and ask Dan to confirm it arrived before I send the rest.

      Risky choice

      It sounds careful, but the criminals will happily confirm the test payment arrived, because it did, into their account. That makes the big payment feel safe when it isn’t.

   3. Stop. The address has an extra letter in it. I won’t pay anything until I’ve spoken to Dan.

      Safe choice

      Well spotted. The real address is harborlinereno.com, and this one has an extra “n”. Even when the address looks right, a change of bank details by email is always a reason to stop and call.

   Red flags at this step

   • “We’ve changed banks” or “our old account is being audited”
   • A sender address with one letter added or changed
   • Pay today, or lose your start date
   • Being told not to use the details you already have

   What's really going on

   Criminals who have been reading the emails know the amount, the invoice number and your start date, so the message fits perfectly. They send it from a look-alike address, or sometimes from the builder’s real account. Scamwatch warns that scammers “will sometimes add one extra letter or number to the email address”, and the FBI says to watch for any change in account number or payment procedures. In the UK, £41.3 million was lost to invoice and mandate fraud like this in 2025.

3. Step 3 of 6 Winning your trust

   Many people would pay straight away. Suppose instead you decide to phone Dan first. His business card is on the fridge, and the new email gives a different number.

   Harbor Line Renovations

   Dan Russo, Owner

   Kitchens, bathrooms and remodeling

   Cell: (617) 555-0118 [email protected]

   The new email says: “You can reach our new office line on (617) 555-0162.”

   Read this aloud

   Which number do you call?

   Not sure? Show a hint

   Which of these numbers did you have before any talk of new bank details?

   1. The new office line in the email. It’s the most up to date.

      Risky choice

      That number belongs to the criminals. Whoever answers will say they’re Dan, or Dan’s office manager, confirm the new account and apologize for the hassle. A number in the same email as the new bank details can’t check anything.

   2. Search for Harbor Line Renovations online and call the first number that comes up.

      Better, but not the safest

      Better than using the email, but be careful. The first results can be paid ads, and criminals sometimes pay for search ads that lead to their own websites. The number on the card Dan handed you is the one you know is his.

   3. The cell phone number on Dan’s business card, which he gave me when he came to measure up.

      Safe choice

      Exactly right. That number came from Dan himself, before any of this started. The real Dan will tell you his bank details haven’t changed, and you’ve just saved $14,800.

   Red flags at this step

   • A new phone number that appears only in the email asking for money
   • Being invited to call a number in the same message

   What's really going on

   Checking by phone is exactly right, but only on a number you already had before this email arrived: a business card, a written quote, a contract or an earlier bill. Scamwatch says not to use the contact details in the email, because they “might have been changed by the scammer.” When you reach the real Dan, he’ll tell you nothing has changed.

4. Step 4 of 6 The ask

   Many people never make that call. Suppose you open your banking app and type in the new account details. Before the money goes, a warning appears.

   Your Bank

   Check the name before you pay

   The name you entered, Harbor Line Renovations, does not match the name on the account you’re paying.

   If you pay the wrong account, you may not get your money back.

   Amount

   $14,800.00

   Name you entered

   Harbor Line Renovations

   Name check

   No match

   Continue anyway

   Read this aloud

   What do you do?

   Not sure? Show a hint

   Your bank is telling you something it can see and you can’t. What is it?

   1. Press Continue anyway. Businesses often use a different name on their bank account.

      Risky choice

      That’s exactly the thought the criminals rely on, and because it’s sometimes true, it’s easy to believe. But a “no match” on a brand-new account, right after an email changing the bank details, is a serious warning. Once the money goes, it can be very hard to get back.

   2. Stop. Cancel the payment and call Dan on the number on his business card.

      Safe choice

      That’s the right call. The warning has done its job. Dan will tell you his bank hasn’t changed, and you can report the emails to your bank.

   Red flags at this step

   • Your bank warns that the name doesn’t match the account
   • A “Continue anyway” button when you’re not sure

   What's really going on

   Many banks now check the name on an account against the name you type in. The UK calls this Confirmation of Payee, and banks in Australia have been rolling out their own Confirmation of Payee since July 2025. It tells you whether there’s a match, a close match or no match. It’s a warning, not a block, so the decision is still yours, and if you ever see it, stop and check.

5. Step 5 of 6 The ask

   Suppose you reply to the email to ask about the warning. An answer comes back within minutes.

   Inbox

   RE: RE: Invoice 2291: deposit for your kitchen

   Dan Russo, Harbor Line Renovations <[email protected]>

   To: me

   Hi,

   No need to worry about that. The warning comes up because the new account is in our trading name, and a few of our customers have had it this week. The bank says it’s fine to go ahead.

   Could you send it in the next hour? Otherwise I’ll have to give your start date to another client, and our next opening is in March.

   Thanks, Dan

   Read this aloud

   What do you do?

   Not sure? Show a hint

   Who is telling you to ignore your bank’s warning? And who benefits if you do?

   1. Go ahead and pay. He’s explained the warning, and I don’t want to wait until March.

      Risky choice

      The explanation is written by the people who own the account. Losing a start date is a nuisance. Losing $14,800 is far worse. A real builder will understand if you take a day to check.

   2. Ask him to email me a letter from his bank confirming the new account, then pay.

      Risky choice

      A letter is easy to fake, and it will come from the same people. Nothing that arrives in this email conversation can prove the account is Dan’s.

   3. Don’t pay. Call Dan on the number on his business card, and tell my bank about these emails.

      Safe choice

      Perfect. The only person who can tell you whether Dan has changed banks is Dan, on a number you already had. Telling your bank helps them warn others.

   Red flags at this step

   • Being told to ignore your bank’s warning
   • “Other customers have had it too”
   • Pressure: pay within the hour, or lose your start date

   What's really going on

   When a bank’s warning gets in the way, criminals explain it away, calmly and quickly. The FBI advises checking payment requests in person or by calling the person, and being “especially wary if the requestor is pressing you to act quickly.” There’s no deadline that’s worth skipping that call.

6. Step 6 of 6 Afterwards

   A week later, someone who paid gets a phone call. This time it really is Dan.

   Mobile

   Caller ID: Dan Russo (builder)

   1. Dan: “Hi, it’s Dan from Harbor Line. Just checking in. We still haven’t seen the deposit come through. Is everything OK for Monday?”
   2. You: “But I paid it last week, to your new account.”
   3. Dan: “New account? We haven’t changed banks. Oh no. I think someone’s been reading my emails.”

   Read this aloud

   What do you do now?

   Not sure? Show a hint

   How quickly does the bank need to know? Is there anyone else who should be told?

   1. Wait a few days, in case the money turns up in Dan’s account after all.

      Risky choice

      It won’t turn up, because it went to the criminals’ account. Waiting gives them time to move it on. Speed is what gives your bank the best chance of stopping or recalling the payment.

   2. Answer an online ad from a company that promises to trace and recover lost payments for a fee.

      Risky choice

      Be careful. People who have just lost money are often targeted by “recovery” services that charge fees and recover nothing. Your bank and the official reporting services don’t charge you.

   3. Call my bank straight away on the number on my card, tell them it was a scam and ask them to recall the payment. Then report it.

      Safe choice

      That’s the right move, and the sooner the better. Keep all the emails, because your bank and the police may need them. Then make sure Dan knows his email may have been broken into.

   Red flags at this step

   • The real business never got the money
   • Anyone offering to recover your money for a fee

   What's really going on

   Call your bank or credit union immediately and ask them to reverse the payment. If the money hasn’t been moved on, it can sometimes be stopped or recalled. In the UK, most bank transfers made because of a scam are covered by refund rules up to £85,000 if you claim within 13 months. Tell the real business too: other customers may be getting the same emails.