In payment redirection fraud, also called invoice fraud or vendor email compromise, a criminal poses as a supplier, often from the supplier’s real but hacked mailbox, and sends new bank details. The next invoice is paid to the criminal, and the loss is often discovered only when the real supplier chases payment.
Warning signs
- A change of bank details close to a large payment date.
- A letter on convincing letterhead, sometimes from the supplier’s genuine email address.
- Urgency, or a reason why the old account can no longer be used.
- A phone number for confirmation that is included in the same message.
How Rooky stops it
Rooky gives you a second, independent path to the real person. Instead of trusting the email and the phone number it supplied, you open Rooky and send that person a verification request. It goes to the phone they registered with Rooky, not to the number, account or meeting in front of you.
They confirm with Face ID, a fingerprint or their device passcode, and you see a clear answer: Verified, Denied or Expired. Requests expire within minutes, so a confirmation belongs to the moment you asked and cannot be replayed later.
Rooky does not listen to calls or read your messages. It works alongside whatever channel the request arrived on.
A simple control for accounts payable
- Keep supplier contacts in Rooky once, during onboarding.
- When bank details change, send a Verify Request describing the change and wait for Verified.
- Denied or expired means the change is not made, and the supplier is contacted another way.
Frequently asked questions
What is payment redirection fraud?
It is when a criminal impersonates a supplier and persuades a business to send payments to a new bank account the criminal controls.
How should I verify new supplier bank details?
Never use contact details from the change request itself. Confirm with a known contact through an independent channel. Rooky sends the check to the contact’s own registered phone.
Verify the person, not the channel
Get Rooky, add the people you trust, and check before you act.
More guides
- How to Protect Yourself From AI Voice Cloning Scams
- How to Verify Someone on a Video Call Is Not a Deepfake
- CEO Fraud Prevention: Verify Urgent Executive Payment Requests
- “Hi Mum” Scam: How to Check It’s Really Your Child Texting
- A Family Safe Word Alternative That Scammers Can’t Copy
- Caller ID Spoofing: How to Know Who’s Really Calling
- Friend’s Account Hacked? How to Verify Messages Asking for Money