A routine invoice can turn into a costly incident when a familiar supplier's payment details suddenly change. A message may arrive in an existing thread, use the vendor's branding, and explain that the company has moved banks. If an employee updates the vendor record and releases payment based on that message alone, the funds may go to an account controlled by a criminal.
Business email compromise (BEC) can involve spoofed identities or access to legitimate email accounts. The FBI warns that attackers exploit ordinary payment workflows, and recommends verifying payment requests and account changes by phone or in person. The FBI's guidance is at https://www.fbi.gov/how-we-can-help-you/scams-and-safety/common-frauds-and-scams/business-email-compromise.
The strongest safeguard is procedural: make it impossible for a single unverified message to change where money goes. A clear callback rule, limited permissions, and independent approval can protect the payment even when an inbox or conversation has been compromised.
Make payment changes a stop-and-verify event
Define a payment-change trigger that applies to every supplier, including long-standing partners. A request to replace a bank account, routing number, beneficiary, payment portal, remittance address, or normal payment method must pause the transaction until a designated employee verifies it. Do not create an exception for a familiar sender, an urgent invoice, or a message that appears to come from an executive.
Train staff to treat urgency, secrecy, new contacts, changed terms, or discouragement of verification as reasons to pause—not as proof alone that a message is fraudulent.
Put the rule in the accounts-payable procedure and vendor onboarding checklist. State who can request a change, who can verify it, who may edit the vendor master record, and who can release funds. A written, repeatable sequence is easier to follow during a busy payment run than informal advice to “watch for suspicious email.”
CISA's business email compromise alert recommends verbal confirmation of supplier payment-instruction changes using a number from a known vendor contact list—not a number supplied in the electronic request. It also recommends limiting wire-transfer authority and using dual approval for certain higher-risk transfers. Its guidance is available at https://www.cisa.gov/news-events/alerts/2015/06/24/business-email-compromise-continues-swindle-and-defraud-us-businesses.
Verify through a channel the message did not control
Call a known vendor contact using a phone number already held in your approved vendor records, a signed contract, or another independently maintained source. Do not call the number in the change request, reply to the email asking for confirmation, or use contact details from a new attachment. Those channels may lead back to the same attacker.
Ask the vendor to confirm the change and the relevant payment details with an authorized representative. Use a short verification script so employees know what must be confirmed, but avoid reading sensitive account data aloud unnecessarily. If the vendor has an authenticated supplier portal or a documented change process, use it as an additional trusted route and verify that the portal itself is legitimate.
Keep vendor contact data under controlled maintenance. When a supplier's contact person changes, verify that change through a known relationship owner before replacing the trusted contact record. For a new vendor, establish and validate the relationship before the first payment. The key is independence: the information used to verify a request must not come only from the request itself.
- Use a pre-existing contact path: call a stored number or use a previously established, authenticated supplier portal.
- Confirm authority: verify that the person is permitted to request the change, not merely that they work for the vendor.
- Record the check: note who confirmed it, when, through which channel, and who approved the vendor-record update.
Separate vendor setup from payment approval
Reduce the chance that one compromised account or hurried employee can redirect money and send it. Limit vendor-master edits to the smallest practical group, use unique accounts with multifactor authentication, and require a second person to review material changes. Separate the employee who changes supplier details from the person who approves and releases the payment whenever staffing allows.
Apply extra approval to higher-risk events: a new payee, a changed bank account, an unusually large transfer, a payment outside normal patterns, or a last-minute change to a scheduled payment. Set thresholds to fit the organization's transaction sizes and banking arrangements. CISA's guidance describes dual approval for new trading partners, changed account details, and transfers outside normal patterns; treat the exact threshold as a business control to define locally.
Where the bank or accounting platform supports it, configure dual authorization, payee controls, alerts for new recipients, and appropriate payment limits. Require a deliberate review before the first payment to changed instructions, and define how to handle legitimate urgent exceptions. An exception should still get a documented independent verification and a second approver; urgency is a reason to use the fast path, not to remove the control.
After each payment run, have an independent reviewer compare the vendor record, invoice, and payment confirmation. This can expose mismatches before they recur.
Strengthen email security without relying on appearance
Technical safeguards help reduce the chance of account takeover and spoofing, but they do not prove that a payment instruction is valid. Enable multifactor authentication for email and finance users, remove unused accounts promptly, and review mailbox forwarding rules, delegated access, and suspicious sign-ins. Keep systems updated and make it easy for staff to report suspicious requests without fear of blame.
Train employees to inspect the full sender address and domain, especially on mobile devices, and be cautious with unexpected attachments or links. Banners and filtering help, but a legitimate supplier account may itself be compromised; a familiar conversation is not independent confirmation.
Review payment controls alongside cyber controls. Could a compromised mailbox add a payee, alter the vendor record, or approve a transfer? If so, add an independent contact step, second approver, or system restriction. BEC defense is stronger when identity, vendor records, and money movement are not governed by the same channel.
Prepare the response before a transfer happens
Give accounts payable a clear route to stop a pending payment and reach the finance lead, IT or security contact, and bank. If a request seems suspicious before the transfer, pause it, preserve the original message and relevant records, and verify the vendor through a known contact. Avoid deleting the message or relying on a reply from the potentially compromised thread as proof.
If funds have already moved, contact the originating financial institution immediately and ask it to contact the receiving institution. The FBI's Internet Crime Complaint Center says to request a recall or reversal as soon as fraud is recognized and to file a detailed complaint with IC3. Its response steps are at https://www.ic3.gov/CrimeInfo/BEC. The outcome is not guaranteed, so speed matters; follow your bank's instructions and your incident-response process.
Preserve the request, sender details, message headers when available, transaction reference, amount, timing, and verification notes. Report the incident internally, review whether mailbox or vendor settings changed, and determine whether other payments or vendors may be affected.
Test the process with a short tabletop exercise: a supplier emails new bank details just before a payment cutoff, the usual contact is unavailable, and the requestor insists that a delay will incur a penalty. Can staff place the payment on hold, find a trusted number, reach a second approver, and escalate quickly? Review exceptions and near misses at least periodically. A control that works only when everyone is calm and fully staffed is not a reliable payment control.
Payment security depends on separating a convincing message from a verified instruction. Set the rule before the next invoice arrives: pause bank-detail changes, confirm them through an independently sourced channel, and require the appropriate second review before money moves. That small operational habit can keep a compromised conversation from becoming a completed transfer.
