How to Send Banking Details for Invoices (Without Getting Scammed)

The invoice-fraud trap

Attackers change bank details mid-thread or impersonate suppliers. If you publish account numbers in email footers or long-lived PDFs, you make their job easier. Keep payment info short-lived and verified.

Safe pattern to share bank details

• One-time, expiring link containing your banking info (IBAN/PIX/routing). Keep the window short (24–72h).
• Separate access code sent by a different channel (call/SMS) after you verify identity.
• Zero-knowledge delivery so the provider can’t read content. Basics: Zero-Knowledge Sharing.

Out-of-band verification (non-negotiable)

• Call a known number (from your records, not the email) before you change or accept new bank details.
• Use a shared passphrase or client ID to confirm identity.
• Never trust urgency or last-minute account changes without voice confirmation.

Step-by-step workflow (copy/paste)

• Step 1 — Place banking details in a single-view note with expiry.
• Step 2 — Share the link via your usual channel; send the access code via SMS/phone.
• Step 3 — Verify by phone before the first payment is sent.
• Step 4 — After payment, delete the link and remove any traces in long-lived docs.

Do’s and Don’ts

• Do verify by phone; don’t accept changes via email alone.
• Do use expiring links; don’t put bank details in signatures.
• Do rotate reference links per invoice; don’t reuse the same link forever.

What if you clicked a suspicious payment link?

• Don’t pay. Navigate to the official site from a bookmark and re-verify details.
• Use the CORE routine to check links: Verify Links Like a Pro.

If money might be at risk

• Freeze or recall the transfer if possible and notify your bank immediately.
• Run a quick security response (revoke sessions, rotate, audit): Leaked Passwords Playbook.

FAQ

Is it okay to send bank details in a PDF invoice?
Prefer a short-lived link. If a PDF is required, don’t reuse it—generate per invoice and avoid permanent public copies.

Can I put PIX/IBAN in my email signature?
Avoid it. Email threads get forwarded and scraped. Share payment info only when needed, with verification.

Related reading

Delivery without inbox trails: The Safe Way to Share Passwords in 2025 (No Email)

Compare sharing methods: One-Time Links vs. Encrypted Email

Zero-knowledge primer: The Beginner’s Guide to Zero-Knowledge Sharing

Phishing-proof your process: Verify Links Like a Pro

Respond after a mistake: The Simple Incident Playbook for Leaked Passwords

Bottom line

Payment details should be precise—and temporary. Use one-time, expiring links and phone verification to keep invoice fraud out of your business.

Secure One-Time Messages - Send confidential messages that self-destruct after being read once. Your privacy is our priority. →.