Why payment changes need a separate verification process
Business email compromise, or BEC, is a fraud scheme in which criminals impersonate a trusted person or use a compromised email account to redirect money. The request may appear to come from an executive, employee, attorney, contractor, closing agent, or established vendor. It may refer to a real project and arrive inside an existing email conversation.
The FBI advises businesses to verify changes in account numbers or payment procedures with the person making the request. The FBI's Internet Crime Complaint Center also recommends using a secondary channel or two-factor verification for changes in account information. The central lesson is simple: an email that looks familiar is not enough evidence to change where money goes.
For Central Florida professional offices, contractors, medical practices, schools, property managers, manufacturers, and service companies, a written process can give employees permission to pause an urgent request and verify it without embarrassment or pressure.
The payment-change checklist
Use this checklist whenever a request involves a new vendor, changed bank details, a different payment address, an unusual payment method, an unexpected invoice, an urgent transfer, or secrecy.
1. Stop the transaction
Do not reply, click a link, open an attachment, or call a number supplied only in the request. Do not let a deadline, late-fee threat, executive title, or familiar email thread bypass the process.
Mark the request as pending verification. If an approver insists that the payment is urgent, the verification can be performed urgently; it should not be skipped.
2. Match the request to a real obligation
Confirm that the business actually ordered the product or service. Match the invoice to a purchase order, contract, delivery record, project file, or known recurring expense. Check the vendor's legal name, invoice number, amount, dates, tax information when applicable, and the employee who authorized the purchase.
The Federal Trade Commission warns that fake invoices may resemble bills for familiar business services. Staff should closely review invoices and follow clear approval procedures rather than assuming that a professional-looking document is legitimate.
3. Compare the change with established records
Use the vendor record already stored in the accounting or vendor-management system. Compare the requested bank name, routing details, account ending, mailing address, email domain, phone number, and contact name.
Treat any change as unverified until it is confirmed independently. A request can be fraudulent even when it arrives from a real vendor mailbox if that account has been compromised.
4. Verify through a known secondary channel
Call a known vendor contact using a phone number from the signed contract, an earlier verified invoice, the vendor master record, or the vendor's independently located official website. Do not use the phone number or link contained only in the change request.
Ask the contact to confirm the specific change and the name and role of the person who authorized it. For high-value or unusual changes, require a second authorized person at the vendor to confirm. Record the date, time, number called, person reached, and outcome.
If the supposed request came from an internal executive or employee, contact that person in person or by a known phone number. Do not rely on the original email, text, or chat thread as the second channel.
5. Require two internal approvals
Separate the person who enters or changes vendor payment details from the person who approves the payment. For small offices where full separation is difficult, require a documented review by the owner, controller, office manager, or another authorized employee.
The reviewer should see the original vendor record, independent confirmation notes, supporting purchase documents, and the proposed change. Approval should be recorded before the first payment to the new destination.
6. Inspect the message and account activity
Check the complete sender address, reply-to address, domain spelling, and message history. Look for an external-sender banner, unusual forwarding, changed tone, unexpected secrecy, or a request to bypass normal procedures. These clues can help, but the absence of a clue does not prove legitimacy.
If a real mailbox may be compromised, involve the IT or security provider. Preserve the message and relevant logs. Review mailbox forwarding rules, recent logins, multifactor authentication events, and other suspicious changes as appropriate.
7. Use a controlled first-payment step
After independent verification and approval, update the vendor record through the normal accounting process. Where practical and consistent with the vendor relationship, confirm receipt after the first payment to the new destination using the known secondary channel.
Do not send account details, passwords, or one-time authentication codes by email. Limit who can modify vendor records and review those permissions regularly.
A short verification record
For every bank-detail or payment-procedure change, retain:
- Vendor name and internal vendor identifier.
- Date and time the request arrived.
- Old and proposed payment destination, recorded securely.
- Purchase order, contract, or invoice reference.
- Known phone number or secondary channel used.
- Name and role of the person who confirmed the change.
- Name and time of the internal second approval.
- Date the vendor master record changed.
- Date and result of the first-payment confirmation.
Do not place full bank-account information in an unsecured ticket, email, or shared document. Follow the business's financial-data retention and access rules.
If money was already sent
Act immediately. The FBI's IC3 guidance tells BEC victims to contact the originating financial institution as soon as fraud is recognized and request a recall or reversal. Preserve messages, transaction details, call records, and account information. File a report with IC3 and follow the financial institution's instructions.
Also notify the appropriate business leaders, insurer, legal counsel, IT or security provider, and law enforcement based on the circumstances. Do not keep communicating with the suspected criminal or delete evidence. Resetting accounts or rebuilding systems should be coordinated so evidence is preserved and the actual compromise is addressed.
Put the checklist into daily operations
The process works only if employees know that verification is expected. Add it to accounts-payable procedures, vendor onboarding, employee training, and internal audits. Test it with a tabletop scenario: an established supplier emails new wire instructions on a Friday afternoon and says service will stop unless payment arrives immediately.
A successful exercise should show who pauses the payment, where the known contact number is stored, who provides the second approval, how the verification is documented, and who handles a suspected account compromise.
The objective is not to distrust every vendor. It is to make changes to money movement require stronger evidence than the message requesting the change.
This article is educational and is not legal, banking, accounting, insurance, or incident-response advice.