Swapped bank details on an invoice: the money leaves on a legitimate-looking letter

The scheme is ordinary. An accountant receives an invoice from a counterparty they have worked with for years. The domain looks right, the signature is the same, the tone is normal. Only the account number changes. The payment leaves. A week later the real supplier asks where the money is. The company site still opens, the antivirus is quiet, and management decides "this is not for security".

Sometimes the counterparty's mailbox really was taken. Sometimes the letter was forged so that it only looks like theirs. For you the difference is in the investigation, not in the payment rule. The rule is one: a change of details is not confirmed by a reply in the same thread. A call to the number from the contract that existed before the letter, or a second person who compares the invoice with the previous payment.

What to check on your side, not theirs

• The director's and accountant's mail with a second factor. Otherwise "a letter from us" will be built from your own thread.
• Current details on the site. A stale PDF in the "for clients" section does not help you.
• Who else reads the info@ mailbox and can forward an invoice "as usual".
• A short ban: a new account is not paid by one person alone.

Lexora is called when a mailbox was already taken, or when you want mail and the site closed down before the next invoice. That is an access audit and, if the trail is still warm, incident response. A storefront pentest will not catch this swap: it is not in the store code. We say so, so we do not sell the wrong job.