An urgent request can look routine when it arrives in an existing email conversation. The most useful control is a payment process that still works when a message, voice, or video cannot be trusted on its own.
Verify a payment change outside its message
An established contact route provides the check when an email or voice cannot be trusted.
Establish the verification route beforehand
Keep approved vendor contacts and bank-detail change procedures in a controlled location. A request to change the destination of a payment should be verified through a contact already established independently of that request. Do not use a new telephone number or link supplied in the same message as the change.
The FBI’s business email compromise guidance recommends independently verifying payment requests and changes in account or payment procedures. A familiar voice does not replace that check; voice cloning adds another reason to follow the agreed process.
Define who requests a change, who verifies it, and who approves the payment. Where practical, separate those responsibilities. Record the result in the purchasing or finance system so a later reviewer can follow the decision. Give staff permission to pause an urgent payment and a known escalation contact when the normal approver is unavailable.
Respond quickly to a suspected mistake
If funds may have been sent fraudulently, contact the financial institution immediately using a trusted channel and follow the organization’s incident process. Preserve the original messages, transaction details, and relevant account activity. Recovery prospects depend on the circumstances; a technical investigation should not delay the bank contact.
The technical response team handles mailbox investigation, incident coordination, and the controls behind email security. Finance and management retain the payment authority. Practice the handoff together so a security control does not depend on one person recognizing a scam under pressure.