The invoice looks familiar. The work was done. There’s just one change: your supplier says the next payment needs to go to a different bank account.
Before anyone changes the payment record, pause and confirm the request through a contact route you already trust. Call a number held in your verified supplier records, rather than the number in the new message. Then have the change approved through your normal payment process. A reply in the same email thread isn’t an independent check.
I’d make this a written rule for the whole business, including requests that appear to come from the owner. The busiest person in the office shouldn’t have to invent a fraud-checking process while a payment deadline is approaching.
A real invoice can still send money to the wrong place
Business email compromise is a scam that uses an apparently legitimate business message to redirect money or information. A criminal may impersonate a supplier or gain access to a genuine mailbox. That means a familiar name, an existing conversation and correct project details don’t establish that new payment instructions are genuine. The FBI’s Internet Crime Complaint Center guidance recommends independently verifying changes to account numbers or payment procedures.
Think of two separate questions: Do we owe this invoice? And have we verified where the payment is going? Approving the first doesn’t answer the second.
Give the change a clear path through your office
Here’s a hypothetical example. A small contractor receives an invoice for materials already delivered. The supplier’s email says its usual account is being audited and asks for payment to a new account today.
The office manager holds the change, calls the supplier using its previously verified contact details, and checks whether the request came from an authorized person. A second person reviews the verification record before the payment details are updated. If the contact can’t be reached, the request stays unresolved and goes to the designated manager. The deadline doesn’t become permission to skip the check.
That’s an example of a process to agree with your finance team, not a claim about a customer incident. Your accounting software and bank may support different approval controls, so confirm what your actual systems can enforce.
The FBI also spells out the trusted-number and secondary-approval approach in its 2017 business email compromise advisory. That is older prevention guidance, not a new threat announcement. Build the verification step into a process your team can follow when the usual bookkeeper is out.
| Question to settle | What to record before the next change |
|---|---|
| Who receives a request to change supplier payment details? | A named role and a backup person, with one place to track the request. |
| Where do we find a trusted callback number? | The verified supplier record and who is allowed to change it. A new number supplied alongside new bank details needs its own verification. |
| Who can confirm the change at the supplier? | An established, authorized contact and an agreed alternative if that person is unavailable. |
| Who checks the verification before the account is updated? | A reviewer separate from the person entering the change where staffing allows, plus a defined escalation route. |
| What evidence do we retain? | Who checked, when, which trusted route was used, what was confirmed and who approved it. Keep banking details in the approved restricted system. |
| What happens when something doesn’t match? | Hold the change, tell the responsible manager and contact IT if email compromise is suspected. |
If your business has only one person handling payments, name an owner or other authorized reviewer for changes. Don’t call a process “two-person approval” if the same person performs both steps under different logins.
Make sure the software supports the rule
This is where your IT and finance responsibilities meet. Finance decides who may approve a payment change. IT helps make sure accounts, permissions and records support that decision.
Ask your provider to walk through who can edit supplier details, whether approval history is available, and whether a person can approve their own changes. Include anyone with administrative access. An application may require a different plan or configuration to support the workflow you want; a checkbox in a policy doesn’t mean the control is active.
Use individual accounts so you can attribute changes to a person. If several employees currently share a bookkeeping login, our guide to replacing shared logins explains how to keep shared work moving while separating access.
Email protection and multifactor authentication, which adds a verification step to signing in, also belong in the discussion. They help protect accounts, but they don’t approve the destination of a payment. Ask about the controls around the transaction as well as the inbox.
Practice once without sending money
Set aside a short session with whoever handles supplier invoices. Use a clearly marked fictional request with placeholder account details. Don’t change a real supplier record or send a test payment.
- Ask the recipient where they would record and hold the request.
- Have them show where the trusted supplier contact would come from.
- Identify the verifier, approver and backup people.
- Walk through what happens if the supplier can’t be reached or the requester says it’s urgent.
- Agree where the completed verification would be stored and who can see it.
The useful result is a short list of gaps: perhaps the backup person can’t access the contact record, or nobody knows who approves a change when the owner is away. Fix those gaps and repeat the walkthrough. Treat questions during the exercise as improvements to the process, not staff failures.
If a suspicious payment has already gone out
Contact your bank immediately through its official channel and tell it you suspect payment fraud. Ask about the steps available to recall or reverse the transfer. The FBI’s Internet Crime Complaint Center recommends contacting the originating financial institution promptly and filing a detailed IC3 complaint. Acting quickly matters, but recovery is not guaranteed.
Alert your IT provider and the person responsible for incident response. Preserve the messages and transaction records, and avoid continuing the discussion through a mailbox you suspect is compromised. Your bank, IT team and appropriate advisers can coordinate the next steps for the actual incident.
Start with the next supplier change
You don’t need a long policy document to identify who pauses a change, who verifies it and who approves it. You do need those people to know the process and have the access to carry it out.
IT MGMT’s cybersecurity services can help connect account protection, staff guidance and technical controls. If you’re unsure how your current tools support payment verification, book a Business IT consultation. Bring an outline of the workflow and the questions your walkthrough raised, without sending passwords or banking details through the booking form.