The 'bank details changed' email that drains agencies

Your Bali DMC emails three days before a 22-pax departure: "Please note our bank account has changed, kindly remit the balance to the details below." Same tone, same signature, same thread you've been replying to for a month. You wire ₹4,80,000. Two days later the real DMC calls asking where the payment is.

This is supplier email fraud, also called business email compromise, and it targets travel agencies harder than most businesses because everything about a DMC payment is built to make you move fast: large amounts, a hard departure date, a wire transfer, a supplier you've usually never met in person. Nothing about the transaction looks unusual until the money is already gone.

This post covers the three ways the scam reaches your inbox, the one control that stops all three, two backup controls, what India's banking liability rules do and don't cover, and what to do in the first hour if it already happened.

Why travel payments are the easiest target in the building

Supplier email fraud works against travel agencies because DMC payments have every feature fraudsters look for: large, deadline-bound, sent by wire to an overseas counterparty, authorised under time pressure. The US FBI's Internet Crime Complaint Center defines business email compromise as a scam targeting "businesses or individuals working with suppliers and/or businesses regularly performing wire transfer payments," carried out by compromising email accounts or spoofing them through social engineering (FBI IC3 2024 Annual Report). That's almost a description of how a tour operator pays a Bali or Vietnam ground handler: ₹3-8 lakh, by SWIFT wire, to a bank you've never dealt with, before a fixed departure date that doesn't move. No domestic instant-payment rail, no walking to their office, no undo button once it clears.

The scale is real, though the only hard numbers available are American. IC3 recorded $2,770,151,146 in reported BEC losses in the US in 2024 alone (FBI IC3 2024 Annual Report). That figure says nothing about Indian rupee losses, but it says the mechanism is common enough to rank among the largest cybercrime loss categories anywhere. No India-specific breakdown for travel agencies appears to exist publicly, a gap in trade guidance, not a sign the risk is smaller here.

The three ways this actually happens

Supplier email fraud reaches an agency's inbox through three distinct routes, and each needs a different kind of alertness to spot.

A genuinely hijacked supplier mailbox. The fraudster is physically inside the DMC's real inbox, usually after a phishing click or a weak password. Every email genuinely comes from the real domain, passes every technical authentication check, and may come from the same staff member's real account. This is the hardest of the three to catch by looking at the email itself, because the sender address is correct.

A lookalike domain. One character is swapped or transposed: balidmc.com becomes ballidmc.com, or a lowercase "l" swapped for a capital "I". On a phone screen, replying to an email you weren't expecting to scrutinise, this is nearly invisible. Tone, signature block, even the logo can be copied exactly from a real previous email.

A reply-chain hijack. The fraudster doesn't send a fresh email; they reply inside your existing thread, quoting your own prior messages back at you. The thread history is real, so scrolling up to "check the earlier conversation" proves nothing. Only the newest reply, sitting at the top, is fraudulent.

None of the three are stopped by "does this email look legitimate." All three are built to look legitimate. The control that works lives outside the email channel entirely.

The bank-detail-change rule that would have stopped it

The single control that stops all three versions of this scam is simple: never move money to a changed or new bank account until someone on your team has called the supplier on a phone number pulled from your own records, not from the email, and verbally confirmed the new details.

That one rule works regardless of which route the fraud came through, because it doesn't depend on spotting anything wrong with the email. It depends on a channel the fraudster doesn't control: a phone number you already had before the email arrived.

Careful: A reply asking "can you confirm this is correct?" sent back to the same email thread proves nothing. If the mailbox is hijacked or the domain is a lookalike, the fraudster reads it and simply types back "yes, confirmed." Email cannot verify itself.

A callback script your team can use:

1. Pull the supplier's phone number from your own file, past invoice, or signed contract, never the one printed in the "changed details" email.
2. Call and ask for the person by name, ideally whoever signs your contracts, not whoever picks up.
3. State plainly: "We received an email saying your bank account changed. Can you confirm the new account number and IFSC or SWIFT code verbally?"
4. Read the new details back digit by digit, and only then release the payment.

If the call doesn't happen, the payment doesn't go out, on the busiest release-of-payment day as much as any other.

Two more controls: an approval threshold and a first-payment test

Two smaller controls catch what the callback rule alone might miss under pressure.

Set a specific rupee threshold above which no payment leaves the business without a second person's written sign-off, separate from whoever initiated it. Say ₹1,00,000: anything above needs a second name attached before the wire is sent, even if the requesting colleague swears it's urgent. A second pair of eyes is the cheapest fraud control there is, the one most five-person agencies skip because "everyone already knows everyone."

Treat any new supplier, or one whose bank details just changed, as unverified until a small test remittance clears. Send a token amount, ₹1,000-2,000 is enough, then call on your own recorded number to confirm receipt before releasing the full balance. That costs a day; a fraudulent full-balance wire costs the whole booking's margin.

Example: Say your agency runs 20 Vietnam departures a season through one ground handler. Mid-season, an email arrives saying their bank changed. Your team calls the handler's owner on the number saved from last year's contract. The owner says no, nothing changed, and forwards the fraudulent email back to you. The ₹5,20,000 balance goes out on the original account, on schedule, and nothing is lost except the ten minutes the call took.

What India's zero-liability banking rule actually covers, and what it doesn't

Do not assume India's banking liability rules will get a fraudulent DMC payment back for you. RBI's framework on limiting customer liability in unauthorised electronic transactions is built around payments made without the customer's knowledge, like a stolen password or a hacked account, not a wire your own staff was tricked into approving after reading a convincing email.

RBI's circular sets a tiered liability structure, in force as of August 2026: zero liability if you report within 3 working days of the bank's notification; a capped liability (roughly ₹10,000 for MSME current/CC/OD accounts, up to ₹25,000 for other account types, per the circular's table) within 4-7 working days; liability per the bank's own board-approved policy beyond that; and the bank must provisionally credit the disputed amount within 10 working days of your complaint, pending resolution (RBI circular on customer protection for unauthorised electronic banking transactions).

Read the framing carefully: it covers transactions "made without the customer's knowledge/consent." A supplier email fraud payment is different. Your own team looked at the details, believed them, and authorised the wire. Whether this circular's protections extend that far is genuinely unclear from the primary text and not a settled point (as of August 2026). Confirm the actual position with your bank's fraud desk and a lawyer, and read how RBI rules govern paying foreign DMCs and hotels for the compliance side of the same payment.

Your own invoices are exposed too

The same scam runs in reverse: a fraudster impersonates your agency and sends a fake invoice to your own client. Three baseline defences reduce that risk.

Turn on two-factor authentication on every business email account, especially whichever inbox sends payment requests to clients. This is the single highest-leverage step against your mailbox being the one that gets hijacked.

Set up SPF, DKIM and DMARC on your domain. In plain terms, these are technical records telling receiving mail servers what to do with an email claiming to be from your domain but not actually sent by your systems: reject it, quarantine it, or let it through. Google Workspace's documentation describes DMARC as telling receiving servers "what action to take" on messages that fail authentication (Google Workspace Admin Help), and Microsoft lists the same three records as the standard defence against domain spoofing (Microsoft Learn, Defender for Office 365). Ask whoever manages your domain's DNS to set these up if they aren't live already.

Check inbox forwarding rules every time you or a staff member resets a password. A hidden auto-forward rule quietly copying every email to an outside address is the classic sign a mailbox was already compromised, and it's invisible unless someone opens the settings and looks.

The first hour after you discover it

If you've just realised a payment went to a fraudulent account, speed matters more than anything else, and every step below should happen inside the first hour.

1. Call your bank's fraud or SWIFT desk immediately and ask them to request a recall or hold on the wire before it settles. Wires that haven't fully cleared can sometimes be pulled back; ones that have, usually can't.
2. File a complaint at cybercrime.gov.in under Financial Fraud, and call the national cybercrime helpline, 1930, the number the portal directs financial fraud victims to use (National Cyber Crime Reporting Portal).
3. Contact the real supplier through a verified channel, a phone number from your own records, not the compromised thread, and confirm in writing what happened.
4. Decide what you tell the affected departure's clients, truthfully, without triggering panic before you know whether the payment is recoverable. A vague "we're resolving a payment issue with our ground partner" holds until you have facts.

Speed genuinely helps. IC3's Recovery Asset Team processed 3,020 fund-freeze requests covering $848.4 million in attempted losses in 2024, succeeding on 66% of the requests it acted on in time and freezing $92.5 million of it (FBI IC3 2024 Annual Report). That program is American with no confirmed Indian equivalent, but the lesson travels: a wire reported within hours has a real chance of being frozen. One reported within a week almost never does. For the fuller recovery playbook, see what to do in the first 24 hours after wiring money to a fake supplier, and vet any new DMC against the fake-DMC checklist before the first payment, not after the tenth.

Common questions

Cyber fraud complaint india

File at cybercrime.gov.in under the Financial Fraud category, the portal's own stated route for reporting online financial fraud. Do this the same day, not once you've finished sorting it out internally.

Cyber crime complaint india number

The National Cyber Crime Reporting Portal directs financial fraud victims to call 1930, the national cybercrime helpline (cybercrime.gov.in). Save this number in your shared team contacts now.

Online fraud complaint india helpline no

1930, run alongside the online complaint portal above. File both in parallel: a recorded complaint number and a live human aware of the case, as fast as possible.

The short version

• Supplier email fraud (business email compromise) hits travel agencies hard because DMC payments are large, deadline-bound wires to an overseas counterparty you've likely never met.
• It arrives three ways: a genuinely hijacked supplier mailbox, a lookalike domain with one swapped character, or a reply-chain hijack inside your own real thread. None look wrong on the surface.
• The one rule that stops all three: never move money on a changed bank account until someone calls the supplier on a number from your own past records, never the email, and confirms verbally.
• Back it with a rupee threshold needing a second person's sign-off, and treat any new or changed account as unverified until a small test remittance clears first.
• Do not assume RBI's zero-liability rule bails you out here. It's built for transactions made without your knowledge, not a wire your own team was tricked into approving.
• Turn on two-factor authentication, set up SPF/DKIM/DMARC on your domain, and check forwarding rules on every password reset.
• If it already happened, act inside the first hour: call your bank's fraud desk to request a recall, file at cybercrime.gov.in, and call 1930.