Did Your Turkish Supplier's Bank Account Change? How to Avoid IBAN Change Fraud

An invoice is due and an email arrives from your Turkish supplier: "Our bank account has changed, please pay the new IBAN." Sometimes this is true. Sometimes the message comes from a fraudster who has got into the conversation. Once money reaches the wrong account it is hard to get back, so treat every change of bank details as unverified until you have confirmed it.

How the fraud works* A compromised mailbox: the fraudster gains access to the supplier's email or yours and waits for an invoice.

* A lookalike domain: the message comes from a domain one letter different, with the same signature and logo.

* A hijacked thread: the email continues a real conversation, with real names and a real-looking proforma.

For the wider fraud patterns and warning signs, see our guide to payment fraud in Turkey.

1. The account holder must match the legal name exactly* A Turkish IBAN starts with TR and has 26 characters. A number that does not fit this format is the first warning.

* The account holder name must match the company's full legal name in the trade registry. A missing word or a different company name is reason enough to stop.

* Do not pay a company through a private individual's account, a group company or an account abroad. The exception: for a sole proprietorship, the account can be in the owner's name, but it must be the registered owner.

* To check the full legal name and tax number, see our Turkish company registry guide.

2. Confirm the change by phone, on a number you already knowDo not confirm by replying to the email that announced the change, and do not call the number in it. Call a number you have used before or found in the company's official records, and ask a person you know, who is authorised, to read out the new IBAN.

3. Ask for a signed letter on company letterheadAsk for a letter on company letterhead announcing the new account, signed by authorised signatories. Check in the signature circular that the signatories hold that authority. More: signature circular in Turkey. For large amounts, you can also ask for a bank reference letter confirming the account belongs to the company.

The legal name, address and tax number on the letter should match the tax certificate and the Trade Registry Gazette. More: how to verify a Turkish tax certificate and how to read the Turkish Trade Registry Gazette.

4. Make a small test paymentSend a small amount to the new account first. Ask the supplier, on the phone number you already know, to confirm the amount and the sender name that arrived. Pay the balance only after that.

5. Protect your own side* Write the IBAN into the contract, with a clause that any change of bank account is valid only after a signed letter and a phone confirmation.

* Use strong passwords and two-step verification on your email accounts.

* Require a second person to approve payments to a new or changed account.

Warning signs* A last-minute account change blamed on an audit, a new bank or a currency problem.

* A request for secrecy: "please do not call about this change".

* Pressure to pay immediately.

* A sender address with a letter changed that is hard to spot.

* An account holder name that does not match the legal name, or a bank in another country.

If the money has already goneCall your bank immediately and ask it to recall the payment. The first hours matter most. Keep all emails and payment records, tell the genuine supplier through a channel you trust and take legal advice. Do not pay anyone who offers to recover the money for a fee.

How we helpEnterTurkey Lite ($199, 24 hours) checks the company behind the quotation and that the person you deal with is authorised to act for it. We also check whether the account holder on the IBAN you share is consistent with the company's legal name. Pro ($499, 48 hours) adds official-source research and an exterior check of the address. See the packages.

This article is general information, not legal or financial advice.

Frequently asked questionsHow many characters does a Turkish IBAN have?A Turkish IBAN starts with TR and has 26 characters in total. A correct format does not show who owns the account, so check the account holder name separately.

Could the supplier really have changed banks?Yes. That is why you should not refuse the change, but confirm it: call a known number, ask for a signed letter and send a small test payment first.

Can I pay a company into a personal account?A limited or joint-stock company asking to be paid into a personal account is a warning sign. For a sole proprietorship the account can be in the owner's name, but it must be the registered owner.

I paid the wrong account. What should I do?Ask your bank to recall the payment at once, keep the records, report it to the police and take legal advice. Do not trust anyone who promises to recover the money for a fee.