A supplier emails to say their bank account has changed. The invoice looks normal and the message sits inside a real conversation. This is exactly the kind of payment decision that needs an independent check. Business email compromise happens when email is used to redirect money or sensitive information.
Understand the idea
A real mailbox can be taken over, and an attacker can study a conversation before intervening. Treat a change of bank details as a new approval, even when the relationship is familiar. Verify it using a phone number or contact route held separately from the message requesting the change.
- Change
A message asks you to alter payment details.
- Callback
Verify with a known contact, using a separately held number.
- Approval
A second reviewer checks the exact final destination.
A practical example
For example, a small NGO receives revised details shortly before paying a venue. The finance officer calls the venue using the number in the existing supplier record. The venue confirms that no change was requested. The officer pauses the payment and reports the suspicious conversation for investigation.
What to do next
- Pause the change. Keep the original invoice and message, including headers where available. Do not edit the supplier record while verification is pending.
- Call a previously verified contact. Use the number already recorded in the supplier's approved details, not the new email signature. If no trusted contact exists, establish one through a separate documented onboarding process.
- Read back the specific change. Confirm the supplier, invoice, beneficiary, account details, and effective date. A vague “did you send an email?” is insufficient.
- Require a separate approver. The person approving the destination should examine the verification evidence, not merely acknowledge the first person's decision.
- Record the outcome. Keep who verified it, through which established channel, when, and which payment details were approved.
How to check the result
Keep a record of who confirmed the change and which final account details were approved. If money was sent to a suspicious destination, contact the bank promptly through its verified fraud route.
The message is in an existing email conversation.
That makes it plausible, not necessarily genuine. Confirm the change independently, and involve your bank promptly if a suspicious payment has already been sent.
Sources and useful guides
The following resources provide background and more detailed guidance. Use the sections that match your service and situation.
