A familiar supplier email arrives with new bank details and an urgent invoice reminder. The familiar thread is not enough to establish that the change is genuine. A compromised account can make a fraudulent request look routine.
Leave the payment record unchanged while checking
The FBI’s Internet Crime Complaint Center guidance on business email compromise recommends secondary-channel verification for account-information changes. Use contact information already held through an established relationship, not the telephone number newly supplied in the message asking for the change.
Follow your organisation’s approval process and record who verified the request, through which channel and when. Do not put full sensitive banking information into a widely shared discussion simply to show that a check occurred.
Separate urgency from authority
In an invented example, a buyer is told that a shipment will be held unless payment goes to a new account that afternoon. That deadline does not remove the need to verify the instructions. Escalate the timing problem through the established purchasing and finance contacts rather than improvising an exception alone.
If a transfer has already been made and fraud is suspected, contact the financial institution immediately and follow the relevant reporting process. Keep the original messages and transaction records. Verification is most useful before payment, but a prompt, clear record also matters when something has gone wrong. The aim is a controlled change to a supplier record, not a quick reply to the most recent email.
AI-generated editorial illustration; not a documentary photograph.