The change is the trigger
An invoice arrives inside a familiar email conversation. The work is real, the amount is expected and the sender explains that the supplier has changed banks. Those details make the request plausible. They do not establish that the new payment destination belongs to the supplier. The operational question is what your business does whenever payment instructions change.
The FBI describes business email compromise as fraud involving messages that appear to come from a known source. Its guidance recommends verifying account-number and payment-procedure changes with the person making the request. A small business can turn that principle into a routine workflow: pause the change, use an independent contact route, document the result and then follow the normal payment authorization process.
Establish the contact before the request
Maintain a protected supplier record containing the business name, the established contact and a known telephone number. Capture and verify that information during ordinary onboarding, when nobody is asking for an urgent transfer. Assign responsibility for maintaining it. A contact list is more useful when staff know which record is authoritative and who may change it.
Do not let a payment-change message supply its own verification route. Calling the number in the same email signature can simply continue the conversation with whoever sent the request. Use the established record or independently locate the organization through a trusted source. If the usual contact is unavailable, hold the change and follow an agreed escalation path rather than inventing an exception.
Verify the business request, not the writing style
Explain that you are checking a change in payment instructions. Establish that you have reached the intended organization and an authorized contact, then confirm the relevant details through your approved process. Read back information carefully. A friendly voice, familiar project reference or polished message is context, not a substitute for verifying who is requesting the change.
AI-generated writing and synthetic voices make appearance an especially weak foundation for trust. You do not need to decide whether AI was involved before applying the procedure. The same rule can cover email, messaging apps and phone calls. What matters is that the business independently verifies the instruction before an authorized person changes the payment destination.
Separate changing the record from paying
Decide who can request a supplier-record change, who can approve it and who releases a payment. In a very small company, the available people may be limited, but responsibilities should still be explicit. Where possible, have another authorized person review a destination change. Avoid letting seniority or an approaching deadline bypass the agreed verification step.
Keep the verification record concise: supplier, request date, independently used contact route, person reached, approver and outcome. Store sensitive banking details only in the approved financial system, not scattered through email notes. The record should demonstrate how the change was checked. It should not become an unnecessary extra collection of account information that more people can access.
Make a pause operationally acceptable
Tell staff and regular suppliers that payment changes receive an independent check. Give the person processing invoices clear words to use: the change is on hold while the established contact confirms it. When a pause is expected, an employee does not have to choose between following a security process and appearing to obstruct a colleague’s urgent request.
Practice with a fictional invoice and invented account details, without initiating a real transfer. Ask someone to locate the supplier record and explain how an unusual request would be escalated. Include a scenario where the person apparently requesting the change is the owner. The exercise tests whether the process survives pressure, not whether staff can spot an intentionally obvious spelling mistake.
Prepare for the wrong payment too
Write down the official contact route for the bank or payment provider and who may request assistance if a suspicious payment has already been sent. The FBI advises contacting the financial institution promptly and reporting business email compromise through IC3. An existing contact plan is easier to use than a web search performed during a stressful discovery.
Review the procedure when suppliers, finance responsibilities or payment systems change. Keep the first action easy to remember: a changed destination needs a separate verified conversation. That habit can be used without proving a message is fraudulent, accusing a legitimate supplier or relying on a person’s ability to judge how an authentic email ought to sound.