A vendor emails that their bank account has changed

Classic vendor impersonation. The mail might be real, more often it is not. The question is not whether the mail looks convincing, the question is whether you confirm the IBAN over a second channel.

Try this first

1. 1Pause before paying. Call the vendor on the number already in your records, not the one in the email or signature. Ask whether the IBAN change is real.
2. 2Check the sender for small deviations: extra letter, different TLD, IDN tricks like a Cyrillic 'a'. If you have an external-sender banner, check it is set.
3. 3Inspect the mail headers in Defender for Office or via Show original. Watch for compauth=fail, dmarc=fail, or a Reply-To that differs from the From.
4. 4Agree on a hard rule with finance: every IBAN change requires a callback confirmation plus an internal mail confirmation from the finance lead. No exceptions, not even when it is urgent.
5. 5If a real phish was involved, check whether other vendors 'changed' details in the same period. BEC crews often work through a full vendor list.

None of the above fits?

Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.