EXCUBOCall-back rule for payment and bank-detail changes
A one-page rule to fill in, sign and pin up next to whoever pays the bills. It targets a common and costly business payment fraud: a convincing request to pay a new account.
1 Our rule
At , we never change bank details or pay a new account because of a message alone. Before any change to a supplier's, customer's or employee's bank details, and before any payment above , we:
- Call back on a number we already had on file (past invoices, contract, our contacts). Never a number, link or address given in the request.
- Confirm with someone we know at that business, and note who, when and what they said.
- Get a second approval for payments above , from . If one person runs the business, wait hours and confirm by a second channel.
- Stop and tell if anything doesn't match, or if we are pushed to hurry or keep it secret.
No one here will be blamed for slowing down a payment to check it. A real supplier will wait a few hours. A fraudster won't want to.
Signed: Date:
2 What counts as a change
- A new IBAN or account number, or “our bank has changed”.
- An invoice that looks normal but shows different bank details.
- A request to pay a different company name, or an account in another country.
- An urgent, one-off payment to someone you have never paid before.
- A call, voice note or video call from “the boss” asking for a transfer.
3 Verification log
Write down every check. It takes a minute and gives you a record if something goes wrong.
| Date | Who asked | What change | Number called | Confirmed by | Approved by |
|---|---|---|---|---|---|
4 If money has already gone
- Call your bank at once on the number on your card or its website, and ask them to stop or recall the transfer.
- Report it to the police. In Spain you can also call INCIBE's free cybersecurity helpline, 017. In the US, report it at ic3.gov.
- Keep every email, message and call record. Don't delete anything.
Part of the free Excubo template kit. Linked fixes come from the Impersonation Readiness Check. General guidance, not legal or financial advice. Reviewed 27 October 2026.