An invoice can be well written, correctly branded, and attached to a genuine email conversation while containing a fraudulent payment destination. A familiar voice may support the request without proving who is speaking. Finance staff need a process that remains dependable when those signals look convincing.
Keep the bank-change decision traceable
A genuine email conversation can still contain a fraudulent destination.
The control should attach to the consequential action: creating a supplier, changing bank details, approving an unusual payment, or releasing funds. Trying to decide whether a message was generated by AI is a less reliable place to put the decision.
Use a contact that predates the request
Verify banking changes through a known, independently maintained contact route. Do not call the number in the same email or amended invoice you are checking. If the normal contact is unavailable, use an approved escalation or defer the change rather than accepting a substitute introduced by the request itself.
The FBI's business email compromise guidance recommends verifying payment requests and changes to account information. The safe payment guide helps translate that into an operating procedure with clear responsibilities.
Record who was contacted, through which established route, and who authorized the change. Apply the same rule to requests attributed to senior management. Urgency and authority should trigger the agreed escalation, not remove verification from the process.
Keep approval separate from changing the record
Decide which staff can maintain supplier information and which can approve or release payments. Where practical, require independent review for consequential changes. Set arrangements proportionate to the organization, including a documented alternative when a very small team cannot fully separate duties.
Use named financial-system accounts, limited permissions, and suitable additional authentication. Review user credentials and access when roles change. Protecting the receiving organization's accounts is important, but it does not make an incoming request from a compromised supplier mailbox genuine.
Check that banking changes and unusual payments leave usable activity records. Review exceptions during normal management oversight. A written policy loses value if urgent payments are routinely allowed to bypass it without any later scrutiny.
Practice the pause and the response
Give accounts payable and reception staff short, relevant awareness exercises. Include a convincing supplier message, a senior person's urgent call, and a request to keep the transaction confidential. Staff should be supported when they stop to verify, even if the request later proves legitimate.
If funds may have been diverted, contact the financial institution promptly through verified details and activate the incident response process. Preserve invoices, messages, payment records, and the timeline. Coordinate investigation and reporting with the responsible parties rather than continuing to negotiate through a possibly compromised email thread.
Before the next supplier change, have finance walk through a harmless test request. Confirm that staff can find the trusted contact, obtain the required independent approval, and retrieve the resulting activity record. Resolve any step that depends on an improvised exception.