A familiar supplier or service provider sends new payment instructions. The message may be genuine, but an existing email thread or recognizable logo is not enough to establish that. The FBI describes business email compromise schemes in which criminals redirect legitimate payments by impersonating a known party or accessing real correspondence.
The task is to verify the change through a separate, trusted route before updating a payee or sending money. A request that creates urgency should make the verification more deliberate, not shorter.
Preserve the request without acting on it
Keep the message, date, requested change and relevant invoice or account reference. Do not click an unexpected link, open an unfamiliar attachment or enter account information through a form supplied by the message merely to “confirm” the change.
Compare the request with your existing arrangement. Note whether the account number, recipient name, payment method or contact details changed. A small difference can matter. Do not rely on a quick visual resemblance between long strings of digits.
If the payment belongs to an employer or organization, follow its verification and approval controls. Do not bypass a second approver because the apparent sender is senior or the invoice is overdue. Those are circumstances in which an established process is particularly useful.
Choose a contact route established independently
Use a number or channel from your existing trusted records or an independently verified official source. Do not use the new number in the same message as the changed bank details. The FBI specifically recommends verifying payment requests and account-number changes through a separate contact.
Reach the person or department authorized to confirm payment arrangements. A receptionist may be able to direct the call, but a casual acknowledgment from someone who does not manage billing may not resolve the question. Explain that you are verifying a change before making it.
Do not ask the other party to send you a one-time login code or share yours with them. Verifying a payee does not require handing over control of an online bank account. Keep authentication secrets within the bank's legitimate sign-in process.
Confirm the change in enough detail
Identify the service, account or invoice and ask whether a change was actually requested. Use the organization's approved method to confirm the exact recipient and payment details. Read back critical information when appropriate rather than accepting “yes, it changed” as a complete answer.
Record who confirmed it, the trusted channel used and the date. Keep sensitive banking details in the approved private record, not in a broadly shared email or public task list. The record should make the decision traceable without creating another exposure.
If the person denies the request, is unsure or cannot confirm through an authorized route, stop. Do not send a small “test” payment to an unverified destination as a way of deciding whether it is legitimate. A successful transfer proves only that money can reach that account.
Update through the bank's normal controls
Only after the change is verified, use the financial institution's official payee-management process. Confirm the selected account and compare the entered details with the verified record before saving. Follow any required independent approval or confirmation steps.
Read what happens to already scheduled payments. Changing a saved payee may not automatically update, cancel or redirect every pending instruction. Review the relevant schedule through the bank's supported controls and avoid creating a duplicate payment.
Keep the old arrangement in an appropriate historical record if needed, while clearly marking which details are current. Two unlabeled versions of a payee can recreate the confusion at the next payment.
Know the immediate response to a suspected mistake
If money may already have been sent to a fraudulent destination, contact the financial institution immediately through its official channel. The FBI also directs victims to report business email compromise to its Internet Crime Complaint Center. Prompt action matters; do not wait to assemble a perfect report before calling the bank.
Preserve the messages and transaction details and follow the institution's instructions. Do not send another payment to someone promising recovery for a fee. A new request can be part of another fraud rather than a solution to the first.
Completion means the intended change is independently verified, the saved payee and scheduled instructions are checked and the evidence is recorded. If verification fails, a stopped payment process with a clear escalation is the correct outcome.
Sources
- FBI: Business email compromise
Verify changed payment instructions through an independently established channel; contact the financial institution promptly if funds may have been misdirected.