Why this matters
A common fraud is for a criminal to pretend to be a supplier and ask for payments to go to a new bank account. The request often comes from a real email account that has been hacked, or from an address that looks almost the same, and may include a convincing invoice or letter. Money paid to the wrong account is often impossible to get back.
This policy explains how we protect agencies that pay us, and how we protect ourselves when we pay our suppliers.
We never change our bank details by email alone
Templace never changes its bank details by email alone.
We accept payment by bank transfer only. We will never ask you to pay by card, direct debit, cryptocurrency, gift cards or any other method, and we will never press you to pay to a new account urgently.
If our bank details ever change, we will confirm the change in both of these ways. Until you have checked the change as set out in the next section, keep paying to the account you already use:
- by phone, calling you on the number we already hold for you;
- by a letter on our letterhead.
How to check a change
We ask agencies to verify any change in the same way. A letter on its own, or an email with a letter attached, is not enough: always make the phone check too.
If you receive a message that appears to come from us asking you to pay to a different account:
- do not reply to it, call any number in it, or click its links;
- phone us on the number you already hold for us, from an earlier invoice, your agreement or our website typed in yourself, and ask us to confirm the change;
- check that you have also received a letter on our letterhead;
- do not pay to the new account until you have spoken to us and the change is confirmed;
- if your bank warns that the account name does not match when you set up or change the payee, stop and phone us.
How we pay our own suppliers
We apply the same rule to ourselves. Templace pays its own suppliers only after verifying any change to their bank details.
No one at Templace may change a supplier's bank details, or pay to new details, because of urgency or because of an email that claims to come from the Director. When a supplier asks us to change its bank details, we:
- do not act on the email or letter alone;
- phone the supplier on the number we already hold for it, not a number given in the request, and confirm the change with someone we know or can verify;
- record who confirmed the change, when and how;
- check with the supplier that the first payment to the new account has arrived.
Warning signs
Be suspicious of any message that:
- asks you to change the account you pay, for example because our usual account is said to be under audit or closed;
- comes from an email address that is slightly different from the one we normally use;
- is unexpectedly urgent, or asks you to keep it confidential;
- asks for payment by any method other than bank transfer;
- includes an invoice with different bank details, or formatting that does not look like ours.
Workers' bank details in the Service
Criminals also target agencies by asking to change a worker's bank details, so that the worker's pay goes to them. The agency is responsible for the bank details it holds for its workers in the Service.
We recommend that agencies:
- confirm any change of a worker's bank details with the worker, by phone on the number already held or in person, before the next pay run;
- be wary of changes requested just before a pay run, or from a new email address;
- limit who can change bank details, using the roles and permissions in the Service;
- use the audit trail to see who changed bank details, and when.
If you think you have been targeted
Act quickly. The sooner you report it, the better the chance of recovering the money.
- If you have paid money to a fraudster, contact your bank straight away. You can call 159 to reach many UK banks safely.
- In England, Wales and Northern Ireland, report it to Report Fraud, the national fraud and cyber crime reporting service that replaced Action Fraud, on 0300 123 2040. In Scotland, report it to Police Scotland on 101.
- Tell us at once on 07789 938284, or at terry@hilliernet.co.uk from an email account you know is safe. If the message claimed to come from us, we will check whether our own systems have been affected.
- If your own email account may have been hacked, change its password, check it for forwarding rules you did not set up, and treat it as a possible personal data breach.
Bank details and payment fraud · version 1.0 · approved 27/10/2026 · next review 27/10/2027. Templace is a trading name of TWH Holdings Limited, company number 10663539, Meadway, Mill Road, Writhlington, Radstock, BA3 5TY.