MYTHOSVerify the change, not the branding
A fraudulent payment request may arrive from a lookalike address or a genuinely compromised mailbox. It can include real invoice details and appear in an existing conversation. Sender authentication and correct spelling are therefore useful observations, but neither proves that new banking instructions were authorised.
The critical action is changing where money goes. Apply the verification process to that action even when the invoice itself is expected.
Use a separate trusted route
- Pause the payment or account-detail change. Record the requested beneficiary, invoice reference and message time in the private payment record.
- Contact the supplier using a number already held in your approved records. Do not use only the telephone number or link included in the request for new details.
- Confirm the change with an authorised supplier contact. Ask for the reason, effective date and agreed written confirmation through the established process. Follow your organisation's rules for a second approver.
- Update the payment system only after the verification is recorded. Keep evidence of who checked the change and who approved it, without circulating full banking data unnecessarily.
Verify the outcome
Compare the beneficiary details used by the payment system with the approved change. A person saying the invoice looks normal is not equivalent to checking the actual destination. Ensure the required approver saw the changed details rather than simply reapproving an old invoice summary.
If money has already moved
Contact your bank promptly through its official app or known telephone number and state that the payment may be fraudulent. Preserve the original request and payment details. Inform the responsible business contact and follow the established reporting process. Recovery is time-sensitive and is not guaranteed by any email-authentication result.
Close the access gap too
If a mailbox may be compromised, its owner or administrator should review sessions, connected apps, recovery settings and forwarding. Do not assume the problem was only a typo in the bank account. Also verify whether other outstanding invoices received similar changes.
Make the routine usable
Keep the supplier callback directory current, including an authorised backup contact. Practise the process before an urgent deadline. A good rule is operationally possible under pressure; it does not depend on a staff member recognising every possible scam from the message's appearance.
Official references
Consult the current vendor documentation if your version or screen differs.
Documentation-based draft. Commands have not all been executed against the named products in a lab. Validate configuration examples against your installed version before changing a working system.