Payment fraud and bank-account-change scams
One email or WhatsApp asking for a transfer to a new account is enough to make a large payment disappear. The messages are often very convincing.
Suspicious bank-change request
- From
- [email protected]Needs checking
- Real domain
- villa-sunset-bali.com
- Message
- “Please pay into our new account from today”Needs checking
- Reply-to
- A personal Gmail addressNeeds checking
Illustration. Names, domains and data shown here are fictitious.
The account changes, the money is gone
Scammers pretend to be you, one of your suppliers, or a travel agent you work with. They announce that the bank account has changed and ask for the next payment to go to the new one.
Sometimes the message comes from a look-alike domain. Sometimes it comes from a real email account that has been broken into, so it appears in the middle of an ongoing conversation. Both are hard to spot at a glance.
What it means for your business
Money is hard to recover
Once a transfer lands in the scammer's account, the chance of getting it back is usually small.
Business relationships suffer
An agent or supplier who lost money may hesitate to work with you again, even though you were a victim too.
Guests get targeted too
Guests who receive fake messages in your name lose money and blame your property.
Warning signs to look out for
Share this list with your front office, reservations and finance staff. When in doubt, ask first.
- A message says the bank account has changed, especially close to a due date.
- Time pressure: “today”, “before 3pm”, or a threat that the booking will be cancelled.
- The sender's address is slightly different from usual, or the reply-to goes to another address.
- The account holder's name doesn't match the company sending the invoice.
- The sender refuses a phone call and only wants email or chat.
- The invoice looks the same, but a small detail has changed, like the account number or bank.
How SiberWisata helps
We combine email protection with someone to ask before you transfer.
Cloud Email Protection
Cloud Email Protection filters email from look-alike domains, flags messages asking to change bank details, and watches your email accounts so they can't be used to send fake invoices.
See this service →Cyber Assurance
With Cyber Assurance, your finance team can forward any payment request they're unsure about. We help check it before the money goes out.
See this service →Monitoring is continuous. Analyst hours and response times are agreed per plan and written into the contract.
Email held: likely payment fraud
The sender uses villa-sunset-bali.co (not .com) and asks for payment to a new account.
Illustration. Names, domains and data shown here are fictitious.
How it works
Email is filtered
Messages from look-alike domains and payment-fraud patterns are flagged or held before staff read them.
Requests get checked
Staff who are unsure just forward the message to us. We tell them if it's safe and what to do.
Habits get stronger
We help set a simple rule: every bank change is confirmed by phone, on a number you already know.
Related threats
All threats →Email account takeover
Work email taken over, including session theft that gets around two-step verification.
Read more →Staff phishing
Fake emails, messages and QR codes aimed at front office, reservations and finance.
Read more →Hijacked OTA accounts
Your partner account on a booking platform is taken over and used to ask guests for payment.
Read more →
Not sure your organisation is safe?
Tell us about your organisation. We look at your situation from the outside and explain what we find in plain language, without obligation.