The invoice can be genuine and the bank details wrong

The amount matches the purchase order. The supplier’s name is familiar. The invoice refers to work your company actually received. Only one detail has changed: the account that should receive the money.

That is enough to turn a routine payment into a different authorization decision. A genuine debt and a genuine document do not automatically authenticate new payment instructions. The invoice may be copied, altered or carried in an account or conversation that no longer has its expected owner.

Business email compromise is often discussed as a writing problem: look for odd grammar, unusual greetings or an executive who sounds wrong. Those clues can help, but a finance workflow cannot depend on them. The stronger question is whether the destination of the payment has been independently verified through a process the incoming message cannot rewrite.

Three approvals hiding inside one invoice

These checks are related but not interchangeable. Someone can accurately confirm that goods arrived while knowing nothing about the supplier’s banking arrangements. A manager can approve an expense without being authorized to change the vendor record.

Combining all three questions into “Does this invoice look right?” makes a consequential change easy to overlook. Separating them creates a useful pause at the exact point where the money could be redirected.

The pause need not stop all business with the supplier. It should stop the unverified change. If established payment instructions remain valid, the finance team can assess that option through its ordinary controls rather than treating the suspicious message as the only available route.

What the FBI guidance supports

The FBI describes business email compromise as fraud involving seemingly legitimate business requests. Its guidance emphasizes independently verifying changes to account numbers or payment procedures. An FBI Las Vegas explanation also discusses the use of compromised or impersonated business communications.

These sources support a narrow but important conclusion: the business context around a message can be real while the requested transfer is unauthorized. They do not establish that every changed bank account is fraudulent.

The following control model is editorial analysis for ordinary finance teams. Contract terms, banking services and organizational responsibilities vary. It is not a statement about who would bear a particular legal loss.

Why the right details can mislead

An accurate invoice number feels like private knowledge. Sometimes it is. But private knowledge and payment authority are different things. A person who sees a conversation may learn the amount, due date, approver’s name and history of the transaction without gaining the right to redirect it.

A forwarded thread can also make an instruction appear older or more established than it is. The reader sees a familiar subject line and assumes continuity. The latest message receives trust earned by earlier, legitimate work.

This is why verification should focus on the change itself. “Are we working with this supplier?” is not the same question as “Did this supplier authorize this new destination for this payment?”

Our explanation of pretexting and trust chains examines how credible surrounding details can carry a request past the point where its authority should be checked.

Design a change request that leaves an independent trail

A vendor bank-detail change should have an identifiable requester, a reason, an independent verification record and an authorized approver. The record should distinguish who supplied the details from who checked them.

Do not make the incoming invoice the only place where the new account exists. An approved vendor-management process can record the change separately and make it visible to the person releasing payment.

Use established contact information from the organization’s trusted vendor record or another independently verified source. A phone number newly added to the invoice, its signature or an attached letter remains part of the unverified request.

If the established contact cannot be reached, treat that as an unresolved change, not evidence that the new contact must be acceptable. Escalation can address urgency without pretending verification has occurred.

What a callback can and cannot establish

A callback is a process, not a magic phrase. The verifier should state the relevant change and confirm it with someone authorized to approve that change. “Did you email us?” may be too vague if the supplier sends many messages.

Avoid disclosing unnecessary banking or employee information while trying to verify the request. Use the minimum information needed under your approved process. When uncertainty remains, involve the accountable finance owner rather than improvising a new identity test.

Two people are not always two independent checks

Dual approval can fail when the second person merely reads the same email and agrees that it looks plausible. Two signatures on one unsupported assumption do not produce independent evidence.

Give each role a defined question. One person may validate the supplier relationship and supporting obligation. Another may verify the bank-detail change through the approved contact route. Payment release can then refer to both records.

This division also makes exceptions more visible. If the usual vendor contact is on leave and the payment is urgent, the unresolved verification should be explicit. It should not disappear behind a supervisor’s general “please prioritize” instruction.

A small organization may not have a large accounts-payable team. Independence can still be designed around a second authorized person, a bank-side control or a deliberately separated verification step. The appropriate arrangement depends on its risk and resources.

The awkward request is often the most important one

Employees may hesitate to challenge a supplier who sounds irritated or an executive who says the delay will damage a relationship. The response should not depend on the junior employee’s confidence in confronting senior people.

A standard policy can make the pause impersonal: new banking details require an independent check regardless of the requester. That rule should also bind executives. Otherwise urgency becomes a way to bypass the control rather than a reason to use a defined escalation path.

The organization should give staff language that describes the process without accusing anyone of fraud. For example, explain that payment-destination changes are verified separately and provide the expected next step.

Our article on manufactured urgency looks at why shrinking the apparent decision window can make an ordinary verification request feel socially costly.

If payment has already been sent

Contact the sending bank’s fraud or payment-support team immediately using an established route. Explain that the destination may have been changed through suspected business email compromise. Ask what action is available for the specific payment type and timing.

A recall or recovery request is not a guarantee of reimbursement. Do not wait for certainty about the email account before contacting the bank. Preserve the transaction references and the original communications for the relevant investigation.

Notify the organization’s incident and finance leads. They need to assess whether a mailbox, vendor record or approval process was affected, and whether additional payments could follow the same incorrect instructions.

Coordinate communication with the genuine supplier through verified channels. An unverified email saying “we fixed the bank details” should not become the recovery process for the original unverified email.

Build a usable evidence package

Keep the original message, attachments, relevant thread, vendor-change record, approval timestamps and payment reference in an access-controlled case. An email screenshot alone may omit information needed for investigation.

Record what each person actually verified. Distinguish a confirmed callback from a planned callback and a supplier’s general acknowledgment from explicit approval of the new destination.

If someone noticed the issue late, capture that observation without turning the record into a blame narrative. Accurate sequencing is more valuable than an account of who should have been more suspicious.

Do not send full bank details, identification documents or account exports to a new “recovery specialist” who contacts the business afterward. Recovery communications need the same independent-channel discipline as the original payment.

A tabletop exercise for the next invoice

Use a fictional supplier and invented payment details. Present a normal invoice followed by a bank-change request near a payment deadline. Ask the team to walk through the actual systems and contacts it would use.

The useful findings are practical: the trusted vendor number is missing; the approver cannot see the change log; the escalation route depends on an absent manager; a payment batch hides destination changes.

Fix those obstacles before measuring whether staff can identify a suspicious sentence. A convincing message should not be able to rewrite the organization’s authorization model.