· Published by Market Money Daily
An invoice can have the right vendor name, the right amount and the wrong bank account. If a familiar supplier emails new payment details, pause the change before releasing money. A convincing invoice is evidence of a request, not evidence that its beneficiary is legitimate.
This is an incident timeline for a small team handling a hypothetical $8,400 supplier invoice. No real company or reported loss is represented. The timestamps are an example of workflow order, not a promise that a bank can recover funds within a fixed number of minutes.
Use it today: identify who can change vendor details, who can approve a payment and which independently saved contact is used to verify changes. If one owner does everything, give those checks separate moments and records rather than treating an email as its own approval.
9:10 a.m. — The Change Request Arrives
A fictional supplier message says its old account is under audit and asks your bookkeeper to use a new account for today's invoice. The invoice matches a real purchase order. The sender's display name looks familiar, and the message stays in an existing email thread.
None of those details verifies the new account. A criminal can impersonate a sender or compromise a genuine mailbox. The FTC's small-business phishing guidance recommends calling a known genuine number rather than acting solely on an apparently familiar request.
Create a hold on the beneficiary change and associated payment. Record the invoice identifier, requested change and staff member who received it. Do not forward a clickable attachment around the company as the team's investigation method.
A useful internal note is short: Vendor payment details changed; verification pending; do not release payment. Avoid putting full bank data in a broadly shared chat. The staff member who normally schedules payments needs the hold status, not an unnecessary copy of sensitive information.
9:15 a.m. — Choose the Trusted Contact
Retrieve a phone number from the supplier record established before this message, the signed contract or a previously verified relationship. Do not use the signature block, attachment or callback number inside the suspicious request. A search result or advertisement is not automatically an independently verified company contact either.
If the record has no trusted number, pause and rebuild the contact through your existing business relationship. That takes longer than replying to the email, but it closes the logical loop: the request should not supply both the account change and the method for approving it.
FTC phishing guidance for small businesses advises using a phone number known to be genuine when verifying an unexpected request. A reply in the same thread does not establish an independent channel if that mailbox is compromised.
For a supplier with several departments, reach the established business contact and ask to be connected to the authorized finance person. Record who confirmed the change and their role. A receptionist repeating a new number from an email is not the same check as the authorized payee confirming its banking instructions.
9:20 a.m. — Make a Specific Callback
Use this operational script, adapted to your relationship: I received a request to change the payment destination for invoice INV-204. I am calling the number already in our supplier record. Did your authorized finance team request this change, and what process should we use to obtain and verify the instructions securely?
Do not read a complete bank account aloud to an unverified caller and ask whether it sounds right. First establish the trusted contact. Then follow your bank's and supplier's appropriate secure procedure for comparing the beneficiary and relevant details.
Ask about the invoice separately from the account. A supplier may confirm that $8,400 is owed while denying the change. Those are compatible answers, and the payment system should retain the original invoice without approving the new beneficiary.
If the contact confirms a genuine change, save the confirmation record and obtain the company's authorized instructions. If the contact denies it, keep the payment on hold and treat the message as a possible impersonation or compromise. If no one can confirm, unresolved remains a valid status.
9:30 a.m. — Separate Verification From Approval
A second authorized person reviews the verified request before the account record is edited or funds are released. Keep verification evidence separate from the person who entered the change. For a two-person shop, this can be a short owner review using the saved contact record and invoice reference.
For a sole proprietor, schedule a deliberate review before payment and retain the callback evidence. External bookkeeping support may help where authorized, but don't invent a second approval by clicking approve twice yourself. The point is an independent check where available and a traceable process in every case.
| Record | Minimum useful contents |
|---|---|
| Change request | Supplier, invoice reference, date and requested change |
| Verification | Trusted contact source, contact person, time and outcome |
| Approval | Authorized reviewer and decision |
| Vendor update | Editor, effective date and secure instruction reference |
| Payment release | Invoice match, beneficiary check and payment identifier |
Restrict access to the record. Staff can know a request is verified without seeing unrestricted account data. Keep rejected changes in the audit trail so a later employee does not reopen the same message and assume nobody checked it.
Before Release — Test the Process, Not the Criminal's Account
Sending $1 to a newly supplied account does not prove it belongs to your supplier. A fraudster can receive the test payment and confirm receipt. Likewise, a bank account that accepts funds is not automatically the correct beneficiary for the invoice.
Follow any account-verification service your bank provides, but understand its scope. A name-match result or completed transfer does not replace checking that your supplier authorized the change. Combine the bank's capabilities with the independent business confirmation and your approval record.
The invoice should match a documented order or completed service. Check amount, currency, due date and whether a payment has already been made. A legitimate banking change can still accompany an accidental duplicate invoice; fraud prevention and duplicate-payment prevention are different controls.
If a vendor pressures staff to bypass the process because goods are waiting, escalate to the owner. Decide how to handle the commercial delay without abandoning identity verification. A deadline does not make a new beneficiary genuine.
If $8,400 Has Already Been Sent — Call the Bank Immediately
Use the bank's established fraud channel and report the suspected transfer. Ask for the available recall, reversal or recovery procedure, depending on the payment method. Supply the transaction identifier, amount, time, beneficiary details and reason for suspicion through the bank's secure process.
The FBI's IC3 guidance advises immediately contacting the financial institution to request a recall after discovering this kind of fraud and filing an IC3 complaint promptly. Recovery is not guaranteed. Do not wait until the supplier responds or until a complete investigation is ready.
Retain the original message, headers if available, attachment without reopening it, transfer confirmation and verification notes. Follow your IT provider's instructions for preserving evidence. Deleting the suspicious thread can remove information needed to investigate the access or destination.
The IC3 cloud-email advisory describes criminals using compromised communications to redirect pending or future payments. Check whether other invoices, saved vendor records or scheduled transfers were affected. One suspicious payment can be the visible part of a wider problem.
Use the reporting routes appropriate to the incident, including IC3, the FTC and law enforcement. The FTC’s business-imposter guidance identifies these reporting routes and advises notifying customers when a business is impersonated. If customer or employee information may have been exposed, obtain qualified advice on response and notification obligations. Do not announce that the incident is contained merely because a password was changed.
The Same Day — Investigate Access Without Promising a One-Click Fix
Ask the email administrator or qualified IT provider to review sessions, forwarding rules, delegated access, connected applications and recovery settings. Change compromised credentials through the genuine provider and enable appropriate MFA. The team should also check whether the apparent compromise belongs to your mailbox, the supplier's mailbox or an impersonated domain.
FTC small-business cybersecurity resources discuss account security, phishing and email authentication. SPF, DKIM and DMARC can help authenticate mail from a domain, but they do not prove that an authorized employee approved a payment change inside a legitimately accessed mailbox.
Notify the supplier through the trusted channel if its identity or instructions are being misused. Coordinate a clear message to affected staff: which invoices are on hold, how verification will happen and who owns the next update. Avoid sending a new set of payment instructions in a rushed warning email.
If insurance might apply, ask the insurer or broker which coverage and notice requirements are relevant. A cyber policy's title alone does not prove reimbursement for social-engineering payment fraud. Preserve the policy and records; do not estimate recovery as certain in your cash forecast.
The Cost Test: How Many Real Sales Replace the Loss?
Assume the fictional $8,400 transfer is unrecovered and the business earns a 28% contribution margin on incremental sales after variable costs. Replacing that contribution requires $8,400 ÷ 0.28 = $30,000 in additional sales. At 20%, the same calculation is $42,000; at 40%, it is $21,000.
Those are planning assumptions, not statistics about typical victims. Contribution margin is not revenue and is not necessarily net profit. Extra staffing, capacity limits or new fixed costs can make the required sales higher; taxes and insurance proceeds are excluded.
Suppose each genuine account-change review takes six minutes and there are 12 requests a year. That is 72 minutes annually. At an assumed $40 hourly labor cost, the review time is $48. This is an operational estimate, not proof of a prevention rate or a quantified expected return.
The useful comparison is the size of the payment exposure and the practical workload of a repeatable control. It does not require pretending that every request is fraudulent. Genuine vendors benefit when your team can verify a change without confusion or repeated emergency messages.
Make Tomorrow's Rule Easy to Follow
Write one policy: payment-destination changes require a callback using previously verified contact details, a recorded outcome and appropriate approval before editing the beneficiary or releasing funds. Add who handles an unavailable supplier and how staff flag an urgent request.
Rehearse with a clearly labeled internal simulation that moves no real money. Give staff a matching invoice, a changed account and an urgent message; check whether they use the trusted record rather than the message's number. Keep the exercise separate from live accounts and do not send deceptive tests to customers.
Next action: review the next scheduled vendor payment and verify that the supplier record already contains a trusted callback route. Fix the missing record before the next account-change email arrives.
Frequently Asked Questions
Is a familiar email thread enough to approve new bank details?
No. A real mailbox can be compromised. Use an independently established contact channel to verify the change itself.
Does a successful $1 transfer verify the vendor?
It shows that money reached an account, not that the account belongs to the authorized supplier. Do not treat it as the missing identity check.
What should I do first after sending money?
Contact your bank immediately through its genuine fraud channel and ask about recovery options. Preserve evidence and report promptly; recovery is not guaranteed.
Does MFA make payment-change checks unnecessary?
No. MFA helps protect access but does not replace verifying a request, and the compromise may be outside your own organization.
Business disclosure: This is general operational information, not legal, banking, cybersecurity or insurance advice. The incident and cost inputs are hypothetical. Use your bank's instructions and qualified incident-response support for an actual suspected transfer.