Build a repeatable process for checking supplier bank changes, urgent executive requests and suspicious business emails before money moves.
Protect the decision, as well as the inbox
A suspicious payment request does not always arrive with a spelling mistake or an unusual attachment. Someone may imitate a supplier, use a convincing conversation thread, or gain access to a real mailbox. Business email compromise targets the decision to transfer money or release information. Email filtering helps, but the payment process also needs an independent check.
Start by identifying the actions that deserve verification: a new beneficiary, changed bank details, an urgent transfer outside the usual cycle, or a request to bypass approval. Give employees a simple rule they can apply during a busy day. A familiar name, accurate invoice number or confident tone is not enough to authorise an exception.
Separate the request from the verification
Use a contact number already held in a trusted supplier record to confirm bank changes. Do not use a phone number introduced by the same email that requests the change. The FBI recommends independently verifying payment requests and changes to account details. Document who confirmed the request, when the conversation took place and which approved record was used.
For a small accounts team, this can be a short checklist attached to the payment record. The person entering a new beneficiary should not be the only person approving the payment. Define a deputy so that the process still works during leave or travel. Apply the same steps when the request appears to come from a senior executive.
Make suspicious messages easy to report
Give staff a reporting route they can find without searching through a policy folder. Explain what to include: the original message, the requested action and whether anyone clicked, replied, entered credentials or transferred funds. Tell employees that early reporting is useful even when they are unsure. A process that punishes honest mistakes can delay the information responders need.
For mailbox protection, enable strong multifactor authentication, review unexpected forwarding rules and restrict unnecessary administrative access. Where supported, use phishing-resistant authentication. Keep these controls connected to a response process: an alert about a new forwarding rule needs an owner who can investigate it, rather than simply another email in an unattended inbox.
Practise a realistic exception
Run a short exercise using a fictional supplier asking for revised payment details just before a deadline. Ask the team to demonstrate where it finds the trusted number, how it records confirmation and who can stop the payment. Do not use real banking details or send a genuine transfer. The exercise should reveal missing steps without creating financial risk.
If a suspected fraudulent transfer has already happened, contact the financial institution immediately through its established channel and alert the organisation's response lead. Preserve the original messages and payment records. The response lead can coordinate account protection, investigation and the appropriate reporting decisions. Avoid continuing the conversation with the suspicious sender while the team is establishing what happened.
Measure the process
Track whether beneficiary changes have documented checks, whether staff know the reporting route and how quickly a suspicious request reaches the right person. Review exceptions with finance and IT together. The aim is a payment process that remains usable under pressure while making unauthorised changes harder to approve.
