The Supplier Is Real. The New Bank Account May Not Be

The invoice is on the right letterhead. The purchase order is real. Even the email thread looks familiar. Then, just before payment, the supplier’s bank account changes.

That is precisely the moment a finance team should stop treating paperwork as proof. A fraudster does not need to invent a supplier from nothing when it can redirect money intended for a real one. The UAE Financial Intelligence Unit (FIU) has documented business email compromise and payment diversion involving altered beneficiary details, spoofed or compromised correspondence and invoices that appear to belong to ordinary transactions.

The failure is not just technical. It is a broken verification chain: the company exists, the debt is legitimate and the employee paying it mistakes those two facts for verification of a third fact, the destination bank account.

Three different questions that companies often collapse into one

When an accounts team receives a revised invoice, three checks are needed. They are related, but neither substitutes for the others.

1. Does the supplier exist? An official economic licence inquiry can help identify the registered entity. The UAE’s National Economic Register provides public licence information and local licensing authorities offer their own searches. A valid licence establishes something about the entity, not necessarily about the person communicating today.
2. Did the supplier really request the change? An incoming message, even one from an established email address, does not settle the issue. The mailbox may have been compromised. Confirm the request by calling a telephone number already stored in your supplier master record, not a number printed on the revised invoice or inside the message requesting the change.
3. Is the beneficiary account the one your company has independently approved? Review the account holder and bank details through a documented process. If they differ from the existing record, require independent confirmation and an authorised second approver before releasing money. A bank account bearing a plausible name is not, by itself, evidence that the person instructing the change is authorised.

The distinction matters because the FIU describes suspicious-transaction cases in which the recipient name differed from the intended beneficiary and payments moved onward through intermediary accounts. It also records impersonation of legitimate suppliers, as well as compromise of real corporate mailboxes.

Why a trade licence and tax number cannot authenticate a bank change

A real licence is worth checking, particularly with a new counterparty. But licence lookup answers a limited question: whether an entity appears in the relevant government records and what business it is registered to conduct. It does not certify every invoice bearing that entity’s name. Nor does it tell you whether a payment instruction was sent by an authorised director or an intruder inside someone’s email account.

The same principle applies when a business checks a tax registration number. A tax identifier may assist invoice due diligence, but it does not verify ownership of the receiving bank account. Treating a verified company name, logo or tax number as complete payment authentication is a category error.

Robius previously examined how legitimate-looking UAE trading companies can build supplier trust before a loss. Payment diversion works differently. The genuine supplier may be an innocent party and the deception may take place inside a legitimate commercial relationship.

A worked example: an AED 84,000 invoice

Consider an illustrative Dubai marketing agency that owes its exhibition contractor AED 84,000 for work completed. The contractor’s invoice matches the quotation. The due date is tomorrow. The accounts employee receives an email saying the contractor has changed banks and attaches an updated invoice.

What is known? The obligation and supplier are established. What is not known? Whether the account change is authorised.

A poor process checks that the invoice looks professional and sends the money. A defensible process pauses the beneficiary amendment, calls the original supplier contact using a previously saved number, records who confirmed the change and how, and obtains separate approval from an authorised manager. If anything conflicts, payment remains on hold until resolved.

That process will occasionally delay a genuine payment. It can also prevent the far more expensive outcome of paying a genuine debt into an unrelated account while the supplier continues to expect settlement.

Five controls that matter more than another awareness poster

• Freeze the old beneficiary record until the new one is approved. Do not let one incoming email automatically overwrite the master payment details.
• Use a callback from the existing supplier record. Do not rely on the new invoice, signature block or caller ID supplied in the suspicious exchange.
• Separate creation from approval. The person entering the new account should not be its only approver, especially for high-value or urgent payments.
• Keep an evidence trail. Save the original request, confirmation date, name of the verifier, approvals and the change history. Avoid storing sensitive identity documents unnecessarily.
• Train for believable messages, not merely bad spelling. A compromised mailbox can send flawless messages in the ordinary language of an existing deal.

Commercial Bank of Dubai and Emirates Islamic both advise independent verification of changes to beneficiary details and stronger approval controls. A separate October 2026 warning from Abu Dhabi Police, reported by Gulf News, described impersonation of business partners to redirect outstanding payments.

What to do if the transfer has already been sent

Move quickly. Contact the sending bank using its official fraud or emergency channel and ask what recall, freeze or trace options may still be available. Record the transaction reference, beneficiary data, the original invoice and the complete correspondence. Report the incident to police through the appropriate emirate’s official service, and preserve the devices and accounts involved for investigation. Do not promise a supplier or employee that funds can be recovered, because outcomes depend on timing, recipient movement and the banks and jurisdictions involved.

If you suspect a mailbox was compromised, contain the account through the email administrator: revoke sessions, change credentials and investigate suspicious forwarding or access rules. Coordinate with the bank and investigators before deleting potentially useful logs.

For residents and businesses dealing with other fraud scenarios, Robius has also mapped the different roles of banks, police and Sanadak when a scam is reported. And tracing fraud-linked assets is not the same as recovering a victim’s payment.

The Robius Read

UAE business email fraud is not only a story about criminals creating convincing fake companies. Sometimes their most valuable disguise is a real business relationship. That is why a licence check, an authentic-looking invoice and a familiar message cannot stand in for payment authorisation.

The operational rule is simple: verify the company, verify the request and verify the beneficiary independently. A business that makes those three separate steps routine is harder to fool than one with the most elaborate invoice template.

Sources and methodology

• UAE Financial Intelligence Unit: Fraud Report, section on business email compromise and payment diversion
• Commercial Bank of Dubai: Business Email Compromise and prevention advice
• Emirates Islamic: Protect your business from supplier impersonation
• UAE Government: National Economic Register and economic licence information
• Gulf News: Abu Dhabi Police warning on changed bank-account instructions, 8 October 2026

Editorial method: official financial-crime reporting, bank advisories and government licence descriptions were compared. The AED 84,000 example and suggested approval flow are illustrative recommendations, not a documented victim case or a legal determination. Checked 27 October 2026.

Robius.news | Dubai, UAE | 2026 | Built to be first. Built to be trusted.