Spotting fake payment requests and bank-detail changes
Bank details are only ever changed by their owner, inside Flamingo, confirmed by a code emailed to them. Treat any emailed request to change bank details or wire money somewhere new as unverified until you have checked it in the app and by phone on a number you already had.
Invoice and bank-detail fraud works by email, not by breaking into anything. Someone emails you claiming to be a contractor, a colleague or a supplier, says their bank details have changed, and asks you to pay the next invoice somewhere new. The email often looks right, because it is copied from a real one.
The defence is a habit, not a tool: never act on payment instructions that arrived by email without confirming them somewhere else.
How bank details actually change on Flamingo
Payout bank details are entered by the person who owns them, in their own Flamingo account, under Payment & Withdrawal → Bank Account Details. Adding or changing an account is then confirmed with a 6-digit code emailed to that person, which expires after 10 minutes. Without that code, the account is not set up.
So:
- Nobody changes a contractor's payout account by emailing you or Flamingo support and asking.
- You cannot change a contractor's bank details for them, and neither can anyone pretending to be them.
- A payout goes to an account that has been added and verified inside the app, not to an account named in an email.
Warning
An email saying "please update my bank details for the next payment" is not how the change is made. If the details really have changed, the contractor makes the change themselves in their own account — ask them to, and do nothing else.
Verify out of band, every time
"Out of band" means: on a channel you chose, not the one the request came on.
- Do not reply to the email, and do not use a phone number, link or address given in it.
- Phone the person on a number you already had — from your own records, before this request existed.
- Ask them to confirm the change out loud, not by text or email.
- Have them make the change in their own Flamingo account, and check it there yourself.
- If you cannot reach them, hold the payment. A delayed payment is recoverable; a misdirected one usually is not.
Caution
A phone number inside the suspicious email is part of the attack. So is a reply-to address that differs from the sender. So is a thread that looks like it continues a real conversation — attackers forward real emails to make the new instruction look like the next step.
No, really — there is no "just this once"
Because bank details can only be changed by their owner, with a code sent to them, an attacker cannot redirect a payout inside Flamingo. So the request you will actually receive is different: pay me outside the platform, just this once.
It usually arrives with a reason that explains why the normal route failed — a bank freeze, a rejected account, a change that "won't save". That reason is the attack. The in-app flow is strict by design, so "Flamingo wouldn't let me update it" sounds like an explanation rather than an excuse.
Caution
There is no legitimate situation in which a contractor needs to be paid outside Flamingo because the platform refused their bank details. If their account genuinely will not save, the answer is to fix the account — not to route the money around it.
Paying off-platform also costs you everything the platform was doing: no payout record against the invoice, no currency trail, no confirmation the money reached the person you contracted with, and nothing for us to investigate if it did not.
The app says the same thing where it matters. On the payroll funding screen and on the pay review step you will see a line stating that Flamingo never asks you to pay a contractor outside the platform, and that these details are never sent to you by email or message. If an email contradicts the app, the app is right.
Signs worth stopping for
- Urgency, or a deadline that leaves no time to check.
- A bank account in a different name, or a different country, from the person being paid.
- A request to pay by a method you have not used with that person before.
- An email address that differs from the one on file by a character or two.
- Secrecy — "don't mention this to the team" is not how real payment changes work.
- An unexpected invoice, or a duplicate of one you have already paid.
Funding a payroll run by wire
Flamingo does show you bank details in one legitimate situation: when a payroll run is funded by wire transfer, the app displays the account to send a USD wire to, together with a reference you must put on the wire.
Read those details from the funding screen inside Flamingo, every time. Do not copy them from an email, a chat message, a PDF or a saved note from last time. If an email hands you wire details, open the app and compare.
Keep the account itself hard to take over
Much of this fraud starts with a mailbox or an account being taken over, not with a convincing forgery. Turn on two-factor authentication — see Set up two-factor authentication (2FA).
If you think you have been targeted
- Stop the payment if it has not left yet.
- Phone your bank if it has.
- Raise a support request with the detail — see Getting help from Flamingo, and what to include. Include the invoice or payout reference, the email address the request came from, and what you have already done.
- If a Flamingo account may have been accessed by someone else, say so in the request.