Use a contact you verified earlier
Hold the payment while you check the change. An instruction in a familiar email thread can still redirect the money to the wrong account. The FBI’s guidance on business email compromise recommends independent verification of changes to account numbers or payment procedures.
Use a previously verified supplier contact. The phone number included in the change request is not an independent check on that same request. Ask an authorized person to confirm the legal beneficiary, bank and account details, along with the reason for the change.
An urgent shipment does not remove the need for this check. Apply the same account-change control regardless of the amount.
Approve the record change before releasing funds
Give the supplier-record update its own approval. One person can collect the evidence and another can check the change. The payment approver should be able to see the revised details and the verification record, rather than finding them for the first time in an invoice attachment.
Record who was contacted, how that contact was established, when verification took place and who approved the update. Store the evidence securely.
If the recipient is a different legal entity, resolve its relationship to the supplier and the commercial reason for paying it. A small test transfer may reveal a routing problem, but it does not replace checking who owns the receiving account.
If the payment has already left
Contact the originating financial institution immediately if you suspect fraud. IC3 advises asking for a recall or reversal and filing a detailed complaint. Recovery is not guaranteed. Do not wait for the supplier to complete its own investigation before alerting your bank or payment provider.
Preserve the messages, invoices, payment identifiers and approval history, and provide them through the bank’s secure process. Keep further payments to the affected supplier paused until the incident and the legitimate instructions have been resolved.