Prove the change outside the requesting message
The payment may be legitimate, but changed destination details need a new verification event and a recorded release decision.
Business purpose
Match the request to the contract, order, delivery, invoice history, amount, and expected payment date.
Known contact
Reach the vendor through a number or account already held in approved records, not details in the change request.
Release control
Have another authorized person review the destination, verification record, exception, and final approval.
Business email compromise often succeeds because most of the transaction is real. The vendor, invoice, amount, work, and email thread may all be familiar while only the destination is changed. Make the control sensitive to that single change. Staff need authority to pause the payment without penalty and a vendor master record whose contact details cannot be silently replaced by the same message requesting payment.
Design for the actual size of the team. A larger organization may separate vendor setup, invoice approval, and payment release. A small organization can require a callback to a known contact, an owner or manager review, and a documented next-day check. If a suspected transfer has already left, speed matters: contact the financial institution immediately, preserve the original request and verification record, and follow internal, insurer, law-enforcement, and provider routes that apply.
- Treat changed destination details as a new control event.
- Use contact information held before the request arrived.
- Record who verified, who approved, and where funds were sent.
A real invoice with false bank details
An attacker enters an existing vendor email thread and supplies a revised invoice. The work and amount are genuine, which makes the request look credible. The payment is held until staff call the vendor using the number in the signed agreement, discover the change is false, preserve the message, and alert both organizations' financial and email administrators.
Vendor payment change verification checklist
Stop the payment at the first destination change. Resume only after the known-channel check and approval record are complete.
Why a real invoice can still direct a fraudulent payment
- A familiar display name, writing style, invoice format, or reply inside an existing email thread does not prove the mailbox is controlled by the vendor.
- Small teams that cannot fully separate duties need a documented compensating control, such as an owner callback and next-day independent review.
- Bank confirmation of an account format does not establish that the destination belongs to the intended vendor.
Evidence basis: The cited sources support the checks above. They do not replace current provider, property, workplace, authority, or local requirements. Federal Bureau of Investigation: Business Email Compromise and Federal Trade Commission: How to Avoid a Scam.
Bank, contract, reporting, and team limits
Authorization, reporting, recovery, insurance, and record duties depend on the business and transaction. Contact the financial institution immediately after a suspected transfer and follow current internal and official reporting processes.