Direct answer
Verify a bank-detail change using a known supplier contact and an existing independent channel before updating the payment record. Email address, signature and a familiar invoice alone do not establish that the request is authorized.
Pause the change
Separate receipt of a request from approval to change a payee. Hold the payment while the finance owner checks the request, especially when it arrives near a deadline or claims that the usual contact is unavailable.
An attacker may use a compromised mailbox or an address that resembles the supplier's domain. A reply to the request could reach the same attacker.
Reference: CISA: Recognize and report phishing.
Call back independently
Use a number from an existing verified supplier record or a previously agreed channel, not a number in the new message or attachment. Ask an established contact to confirm the change and follow the organization's payee-change procedure.
- Record the request date, invoice reference and claimed new account in a restricted case record.
- Use a second approver where the organization's policy requires one.
- Check whether other recent invoices are affected before releasing payment.
Investigate indicators without relying on one
A lookalike domain, unusual reply-to address or unexpected urgency can support escalation. None is conclusive by itself: a legitimate company can change providers, and a genuine supplier mailbox can be compromised. Have the security team preserve the original message and metadata under its normal process.
Reference: NIST SP 800-61 Rev. 3: Incident response recommendations.
If payment was already sent
Contact your bank immediately using its established fraud channel, provide the transaction details and ask what recovery options exist. Notify internal incident contacts and the real supplier. Keep a timeline of actions without promising that a transfer can be reversed.
Reference: FTC: What to do if you were scammed.
Assessment limits
An independent callback reduces the chance of acting on a forged request but cannot guarantee a payment is legitimate. Use your organization's finance controls and bank guidance.
Frequently asked questions
Is an email from the supplier's real domain sufficient?
No. A real mailbox can be compromised. Confirm a payment change through a previously established independent channel.
Should I reply asking if the request is genuine?
Use an independently verified contact instead; the person controlling the requesting mailbox could answer the reply.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.