What should trigger the extra check?
A different bank account, payment destination, payee, or payment procedure deserves a deliberate review. The FBI advises verifying changes to account numbers or payment procedures with the person making the request. Make that a normal business step so a staff member does not need to prove the email is fraudulent before pausing it. Source
Document the trigger, who can place a hold, who confirms changes and who approves release. Name a backup approver; a general warning to be careful does not assign responsibility.
What makes a verification route independent?
Use a number or relationship established before the disputed instruction, or obtain contact details through a separately verified route. Replying to the same email chain is not an independent check. Neither is calling the number that appeared only in the new bank-details message.
IC3 recommends secondary channels or two-factor verification for account-information changes. The business must still define who is authorized to confirm. Reaching a real person at the supplier does not automatically establish that the person can approve a new destination for funds. Source
What is a practical sequence for the team?
Adapt this starting sequence to your bank’s controls and existing responsibilities. It does not remove every fraud risk.
- Pause the requested change and preserve the original message.
- Identify the payee and the person authorized to confirm changes.
- Contact that person through an independently established route.
- Confirm the requested instruction and resolve any conflicting details.
- Document the verification in the restricted payment record.
- Obtain the required approval before updating or releasing payment.
What should the verification record contain?
We recommend recording the request date, the nature of the change, the verified contact route, who confirmed it, and who approved the action. Keep sensitive account information in the system already designated for payment records. A general-purpose team chat is not a substitute for that controlled record.
Avoid recording a reassuring conclusion without its basis. 'Called the established supplier contact and confirmed the change' explains more than 'email looked genuine.' If confirmation cannot be completed, record the unresolved question and keep the change paused under the organization's procedure.
What if the money has already been sent?
Contact your financial institution immediately and tell it the transfer may be fraudulent. The FBI directs affected parties to contact their bank and report business email compromise through IC3. Follow the organization's incident process and preserve the original communications. Do not wait for an email-authentication project to determine the next move. Source
A recovery request is not a recovery guarantee. Separate immediate response from later process review. Email configuration cannot replace payment-authorization evidence and an accountable owner.