Your company receives an email from a regular supplier.
The message looks familiar. It refers to an outstanding invoice, includes the correct company name and explains that the supplier has recently changed its bank account.
Your accounts team updates the beneficiary details and transfers AED 180,000.
A few days later, the genuine supplier contacts your business asking why the invoice remains unpaid.
The money has gone to someone else.
This is the type of fraud highlighted in an October 2026 warning from Abu Dhabi Police, which cautioned businesses against emails impersonating legitimate suppliers and business partners to redirect payments into fraudulent bank accounts.
The warning raises an important legal question for UAE companies:
If your business transfers money to a fraudulent supplier account, can you recover it—and are you still responsible for paying the original supplier?
The answer depends on how the fraud occurred, what evidence is available and which legal remedies may apply.
Why Supplier Bank Account Change Scams Are a Serious Risk for UAE Businesses
On 8 October 2026, Abu Dhabi Police warned companies about fraudulent emails requesting changes to the bank details of legitimate business partners.
According to the warning, scammers exploit genuine commercial correspondence to make payment instructions appear authentic.
The fraud may only become apparent after the transfer has been completed.
This creates two potential financial problems for the affected business.
First, the company may lose the money transferred to the fraudulent account.
Second, the genuine supplier may continue demanding payment of the original invoice.
For businesses making substantial supplier payments, a single incident can therefore create serious cash flow and contractual consequences.
How Does a Supplier Payment Diversion Scam Work?
This type of fraud is commonly associated with business email compromise (BEC) and invoice redirection.
The fraudster may impersonate a supplier, compromise a genuine email account or alter payment instructions within an existing correspondence chain.
A typical scenario involves the following stages:
- A legitimate invoice becomes due.
- The fraudster obtains information about the commercial relationship.
- The buyer receives a message claiming that the supplier’s bank account has changed.
- The accounts team updates the beneficiary details.
- Payment is transferred to the fraudulent account.
- The genuine supplier later confirms that it never requested the change.
Fraudulent messages can be convincing because they may contain accurate invoice numbers, signatures, logos and previous correspondence.
The UAE Financial Intelligence Unit has also identified business email compromise involving altered beneficiary details and payments redirected to accounts controlled by fraudsters.
The fact that an email appears within a familiar conversation does not necessarily establish that the payment instruction is genuine.
What Should You Do Immediately After Sending Money to a Fraudulent Account?
Contact Your Bank and Request an Urgent Recall
The first priority is to contact your bank’s fraud department immediately.
Provide:
- Transaction reference number
- Transfer date and time
- Amount transferred
- Beneficiary name
- Beneficiary IBAN
- Details of the suspected fraud
Ask the bank whether it can initiate an urgent payment recall, contact the receiving bank or take other available steps to protect the funds.
A recall request does not guarantee that the money will be returned.
Recovery may depend on whether the funds remain available, whether the receiving bank can restrict them and what legal procedures are required.
However, delays may reduce the opportunity to intervene before the money is withdrawn or transferred elsewhere.
Report the Suspected Fraud to the Police
The business should promptly report the incident to the relevant police authority.
Depending on the emirate and circumstances, reporting may be available through police stations or official electronic crime-reporting channels.
Provide accurate details of the transaction and the communications used to obtain the payment.
A police report can be important for investigating the fraud and supporting subsequent legal steps.
Preserve Emails, Invoices and Transaction Records
Do not delete the suspicious email or rely only on screenshots.
Preserve the original electronic messages and available technical information, including email headers where possible.
Relevant evidence may include:
- Original supplier invoices
- Fraudulent payment instructions
- Previous supplier bank details
- Bank transfer confirmations
- Email correspondence
- WhatsApp messages
- Internal approval records
- Relevant contracts
- Communication with the genuine supplier
If an email account may have been compromised, involve appropriate IT personnel to secure the account and preserve evidence.
Notify the Genuine Supplier Through a Verified Channel
Contact the supplier using a telephone number or communication method independently verified before the suspicious request.
Explain the situation and ask the supplier to confirm whether any account change was authorised.
Avoid relying on contact details contained only in the suspicious email.
The supplier’s response may help establish whether the instructions were fraudulent and how the deception occurred.
Can a UAE Business Recover Money Transferred to a Scammer?
Potentially, yes, but recovery is not automatic.
The available options depend on the circumstances.
Bank Recall or Recovery
If the fraudulent transfer is identified quickly, the bank may be able to initiate recovery procedures.
The likelihood of success depends on factors including the transfer status, destination account and availability of funds.
Criminal Investigation
A police investigation may help identify the individuals or accounts involved.
Depending on the evidence, the authorities may investigate suspected fraud and pursue appropriate legal measures.
However, a criminal complaint does not guarantee reimbursement.
Civil Recovery Proceedings
Where the responsible party can be identified, civil remedies may be available.
A claim could potentially involve recovery of improperly obtained funds or compensation for losses, subject to applicable legal requirements.
Claims Involving Other Parties
In some cases, the conduct of the genuine supplier, bank or another participant may require investigation.
Liability cannot be determined merely because a payment was redirected.
The relevant contractual obligations, conduct, causation and applicable law must be examined.
Who Is Legally Responsible When Supplier Payment Details Are Changed?
Responsibility may become complicated where the fraud involves more than one business.
Consider three different scenarios.
Scenario 1: The buyer receives a forged email from an unrelated fraudster.
The genuine supplier never changed its bank details, and the buyer transfers the money without independently verifying the request.
The buyer may face difficulty establishing that the original payment obligation has been satisfied.
Scenario 2: The genuine supplier’s email account was compromised.
A fraudster uses the supplier’s actual email account to send altered payment instructions.
The circumstances may raise questions about the parties’ security practices, contractual responsibilities and whether any conduct contributed to the loss.
However, a compromised email account does not automatically establish legal liability against its owner.
Scenario 3: An authorised supplier representative actually issued the instructions.
If the payment change was genuinely authorised, the legal position may differ significantly.
Evidence of authority and the applicable contractual arrangements becomes important.
Each scenario requires an individual assessment.
Does Paying the Fraudulent Account Discharge the Original Supplier Invoice?
Not necessarily.
This may be the most commercially significant issue after the fraud is discovered.
Suppose a company owes its supplier AED 180,000.
The company transfers AED 180,000 to a fraudulent account after receiving forged instructions.
The genuine supplier never receives the money.
The buyer cannot automatically assume that its contractual payment obligation has been discharged.
The answer depends on matters such as:
- The payment terms in the original contract
- Whether the recipient was authorised to receive payment
- Whether the supplier issued or approved the instructions
- The parties’ conduct
- Any relevant representations
- Applicable UAE contract law
If the payment did not legally satisfy the obligation, the supplier may still have a claim for the outstanding invoice.
Businesses should therefore avoid assuming that proof of a bank transfer is necessarily proof of payment to the correct creditor.
Can the Receiving Bank Be Held Liable?
Not automatically.
The fact that fraudulent funds entered a bank account does not, by itself, establish that the receiving bank is legally responsible for the loss.
Banks operate under regulatory obligations, including relevant anti-money laundering and financial crime controls.
However, whether a bank can be held liable in a particular case requires a separate assessment.
Relevant questions may include:
- Whether the bank complied with applicable duties
- Whether there were identifiable warning signs
- Whether the bank received timely notification
- What action was reasonably available
- Whether an alleged failure caused or contributed to the loss
A business should also distinguish between a transfer it deliberately authorised after being deceived and a transaction made without its authorisation.
These situations may have different legal and regulatory consequences.
Rules addressing unauthorised consumer transactions should not automatically be assumed to provide the same reimbursement rights for every commercial payment made by a business.
What Evidence Can Help a Business Recover Its Money?
Evidence should establish both the fraud and the financial loss.
A useful evidence file may include:
| Evidence | Why it matters |
|---|---|
| Original supplier contract | Establishes the underlying commercial obligation |
| Genuine invoice | Confirms the amount and intended creditor |
| Fraudulent email | Shows the misleading payment instructions |
| Previous bank details | Helps demonstrate the unauthorised change |
| Transfer confirmation | Establishes where and when the money was sent |
| Supplier confirmation | Helps establish whether the account change was genuine |
| Bank correspondence | Documents the recall request and response |
| Police report | Records the formal fraud complaint |
| Internal approval records | Helps explain how the payment was authorised |
The quality and completeness of these records may materially affect the investigation and any subsequent claim.
What Happens if the Money Has Already Been Withdrawn or Transferred Abroad?
Recovery may become more difficult if the funds have been withdrawn, divided between accounts or transferred to another country.
In some cases, fraudsters use intermediary accounts to move funds rapidly.
Where money has crossed international borders, recovery may require cooperation between financial institutions and authorities in different jurisdictions.
The available legal measures depend on where the funds went, whether they can be traced and whether the relevant authorities have jurisdiction.
Businesses should not assume that a cross-border transfer makes recovery impossible.
However, it may increase the complexity, cost and time involved.
How UAE Businesses Can Prevent Supplier Payment Diversion Fraud
The strongest protection is a reliable procedure for verifying changes to supplier payment details.
1. Independently Verify Every Bank Account Change
Contact the supplier through a previously verified telephone number or established communication channel.
Do not rely solely on the contact information included in the change request.
2. Require Separate Approval
Bank detail changes should require approval from an authorised employee who is not solely responsible for entering the new information.
3. Maintain Verified Supplier Records
Keep accurate records of approved beneficiary details and the people authorised to request changes.
4. Check the Beneficiary Information
Review the beneficiary name, IBAN and other available account information.
An unfamiliar beneficiary or unexplained change in banking jurisdiction should trigger additional checks.
5. Train Finance Teams
Employees should recognise warning signs such as:
- Unexpected changes to payment details
- Requests for urgent transfers
- Unusual confidentiality demands
- Slightly altered email domains
- Pressure to bypass established procedures
6. Secure Business Email Accounts
Appropriate cybersecurity measures, including multifactor authentication, access controls and account monitoring, can help reduce exposure to email compromise.
7. Document Verification
Keep a record of who verified the change, when verification occurred and who approved the payment.
These records may become important if a dispute arises.
When Should You Seek Legal Advice?
Legal advice may be particularly important when:
- The transferred amount is substantial.
- The bank cannot recover the funds.
- The genuine supplier demands a second payment.
- The supplier’s email account may have been compromised.
- Responsibility between the parties is disputed.
- Funds have been transferred outside the UAE.
- A civil claim or urgent protective measure may be necessary.
A legal assessment can help identify the relevant contractual obligations, available evidence and potential recovery options.
At Precedential Law, we advise UAE businesses on commercial disputes, contractual payment obligations, debt recovery and legal issues arising from suspected financial fraud.
Our legal team can assist in reviewing supplier agreements, evaluating potential claims and identifying appropriate legal steps where fraudulent payment instructions have caused financial losses.
Conclusion
The October 2026 Abu Dhabi Police warning highlights a serious risk for UAE businesses: fraudulent payment instructions can appear to come from trusted suppliers and existing commercial contacts.
A company that transfers money to a fraudulent account may face both the loss of the transferred funds and an unresolved obligation to its genuine supplier.
Recovery may be possible through banking procedures, criminal investigations or civil remedies, but success depends on the circumstances and evidence.
If your business discovers a fraudulent transfer, immediate action is essential. Contact the bank, report the incident, preserve evidence and verify the position with the genuine supplier.
For future payments, independent verification of changed bank details should be a mandatory financial control—not an optional precaution.
Frequently Asked Questions (FAQs)
Can I recover money sent to a fake supplier bank account in the UAE?
Potentially. Recovery may be possible through bank recall procedures, criminal investigations or civil claims, depending on where the funds are located and the available evidence.
What should I do first after discovering a fraudulent bank transfer?
Immediately contact your bank’s fraud department, provide the transaction details and request urgent assistance with recalling or protecting the funds. You should also report the suspected fraud to the police.
Can the bank reverse a fraudulent transfer?
A bank may be able to initiate a recall or other recovery process, but reversal is not guaranteed, particularly where the funds have already been withdrawn or transferred onward.
Do I still have to pay my genuine supplier?
Possibly. Payment to an unauthorised account does not necessarily discharge the original invoice. The legal position depends on the contract, authorisation and circumstances of the fraud.
Is the supplier responsible if its email account was hacked?
Not automatically. Potential responsibility depends on the supplier’s legal duties, the parties’ conduct, relevant evidence and whether any breach contributed to the loss.
Can I file a police complaint for supplier invoice fraud?
Yes. Suspected fraudulent payment diversion can be reported to the relevant UAE police authority through its official reporting channels.
Can I take legal action against the receiving bank?
Potential claims require a case-specific legal assessment. The mere receipt of fraudulent funds does not automatically establish liability.
How can I verify that a supplier’s new bank account is genuine?
Contact the supplier using a previously verified communication channel, confirm the beneficiary details and require appropriate internal approval before changing payment instructions.