An email that appears to come from your supplier says that its bank account has changed. You pay the invoice to the new IBAN, but the genuine supplier later says that no payment was received. In addition to the fraudster’s liability, the dispute may concern whether the original commercial debt was discharged at all.
In brief: Payment to the wrong account does not in every case discharge the debt owed to the true creditor. At the same time, responsibility for the resulting loss cannot be allocated automatically. The source of the message, authority to change payment details, the contract, security practices and the conduct of both businesses must be examined.
Lookalike domain or compromised genuine mailbox?
A message sent from a domain with one altered character is technically different from an unauthorised message sent from the supplier’s real email account. The displayed sender name may not match the underlying email address, and a fraudulent message can also be inserted into an existing correspondence chain.
Saving only a PDF printout may remove useful technical information. Preserve the original email file and header data where possible. Any technical examination should be performed by appropriately authorised persons with attention to evidential integrity.
What should be reported immediately?
Notify the paying bank and the genuine commercial counterparty through a previously known and trusted channel. Calling a telephone number included in the suspicious email may simply reconnect you with the attacker. Ask the bank to investigate the transfer and retain the reference number.
Secure relevant company accounts without deleting records. The incident may affect more than one invoice, so other pending payment instructions should be reviewed. Notification does not mean that a completed transfer will necessarily be returned.
Evidence to assess together
- Contractual provisions concerning payment details and changes of bank account.
- Earlier genuine correspondence and established payment instructions.
- The original suspicious email and full technical headers.
- Invoice, payment approval and internal authorisation records.
- Bank receipt, recipient name and IBAN.
- Incident notifications and any technical investigation report.
If the payee name did not match the company shown on the invoice, record how that discrepancy was treated. A single mismatch does not, however, determine the entire allocation of fault.
Must the genuine supplier be paid again?
Whether the original debt was discharged depends on the rules governing performance to the creditor or an authorised recipient and on the parties’ legal relationship. There is no universal rule that a transfer to a fraudster is treated as payment to the genuine creditor.
If a security failure in the supplier’s systems or conduct of its employee is alleged, that failure and its causal connection to the loss must be proved. The paying company’s verification procedure and its response to an unusual account change can also be relevant. The analysis should not be reduced to the statement that “the email came from their account”.
Criminal complaint and damages claims
A criminal complaint may be made to investigate the offender. The owner of the receiving bank account and the person who sent the email may not be the same individual, and their roles should be investigated. The commercial debt and any damages claim between the businesses remain separate issues.
The claimant should distinguish the transferred amount from any additional losses and deduct sums already recovered. If a cyber-risk or crime policy exists, possible insurance cover should also be reviewed separately.
Frequently asked questions
What if the IBAN on the invoice itself was altered?
The original document, transmission chain and the stage at which the alteration occurred are important. A conclusion should not be based on one copy alone.
Is the bank automatically liable if it did not flag the payee name?
No. The payment system, information supplied and applicable duties must be examined before responsibility can be assessed.
How can similar incidents be reduced in future?
Independent callback verification for account changes and dual approval for unusual payments can be useful controls, although they do not determine liability for the present incident.
DISCUSS YOUR CASE
Discuss a payment diverted by a fraudulent email
We can review the email correspondence, payment instructions and bank records to assess your options under Turkish law.
A brief summary and important dates are enough for an initial enquiry. Send documents only when requested by our lawyers, through the channel they specify. Do not share passwords, one-time codes or wallet keys.
Sources and legislation
Turkish Code of Obligations No. 6098
Turkish Commercial Code No. 6102
Turkish Criminal Code No. 5237
Code of Criminal Procedure No. 5271
Originally prepared on 8 September 2026. This article provides general information on Turkish law. Remedies and deadlines should be assessed against the documents and circumstances of each case. The image is illustrative.
Related reading
I Delivered the Goods but My Invoice Is Unpaid
My Business Partner Will Not Show the Accounts
Related practice area: Corporate & Commercial Law.