What should trigger the extra check?
A different bank account, payment destination, payee, or payment procedure deserves a deliberate review. The FBI advises verifying changes to account numbers or payment procedures with the person making the request. Make that a normal business step so a staff member does not need to prove the email is fraudulent before pausing it.
We recommend describing the trigger in your own payment procedure. State who can place a hold, who confirms a change, and who approves release. A written rule is easier to follow under pressure than a general instruction to be careful. Include a backup approver for times when the usual person is unavailable.
What makes a verification route independent?
Use a number or relationship established before the disputed instruction, or obtain contact details through a separately verified route. Replying to the same email chain is not an independent check. Neither is calling the number that appeared only in the new bank-details message.
IC3 recommends secondary channels or two-factor verification for account-information changes. The business must still define who is authorized to confirm. Reaching a real person at the supplier does not automatically establish that the person can approve a new destination for funds.
What is a practical sequence for the team?
Use the sequence below as a starting point for your organization's procedure. Adapt it to your bank's controls and existing responsibilities. It is a recommended workflow, not a claim that one checklist removes every possible fraud risk.
- Pause the requested change and preserve the original message.
- Identify the payee and the person authorized to confirm changes.
- Contact that person through an independently established route.
- Confirm the requested instruction and resolve any conflicting details.
- Document the verification in the restricted payment record.
- Obtain the required approval before updating or releasing payment.
What should the verification record contain?
We recommend recording the request date, the nature of the change, the verified contact route, who confirmed it, and who approved the action. Keep sensitive account information in the system already designated for payment records. A general-purpose team chat is not a substitute for that controlled record.
Avoid recording a reassuring conclusion without its basis. 'Called the established supplier contact and confirmed the change' explains more than 'email looked genuine.' If confirmation cannot be completed, record the unresolved question and keep the change paused under the organization's procedure.
What if the money has already been sent?
Contact your financial institution immediately and tell it the transfer may be fraudulent. The FBI directs affected parties to contact their bank and report business email compromise through IC3. Follow the organization's incident process and preserve the original communications. Do not wait for an email-authentication project to determine the next move.
A recovery request is not a recovery guarantee. Keep operational response separate from the later review of how the request entered the process. Email identity work can address part of the configuration picture; payment authorization still needs its own evidence and accountable owner.