[{"data":1,"prerenderedAt":170},["ShallowReactive",2],{"publication:en:P085":3},{"meta":4,"copy":17,"relatedArticles":129,"terms":162,"term":163,"resourceParent":164,"glossaryParent":167},{"id":5,"path":6,"kind":7,"keyword":8,"title":9,"seoTitle":10,"description":11,"incoming":12,"updated":15,"preparedOn":16},"P085","\u002Fblog\u002Finvoice-bank-change-scam","article","how to verify supplier bank account changes","How to verify supplier bank account changes before paying","Verify supplier bank account changes before payment","Use a trusted callback, separate approval and a recorded supplier-change check. Know what to do if payment details were changed or money was sent.",[13,14],"\u002Fservices\u002Fcorporate-email","\u002Fservices\u002Fdmarc-spf-dkim","2026-08-15","2026-10-30",{"intro":18,"sections":19,"checklist":88,"faq":94,"links":104,"sources":122,"cta":124},"Verify supplier bank account changes through a previously trusted supplier contact, a separate authorized approval and a recorded update process before releasing payment. Do not use the new number or reply route supplied with the change to verify that same change. If money has already been sent to a suspected fraudulent beneficiary, contact the genuine bank or payment provider promptly while preserving the transaction details.",[20,25,34,70,78,83],{"title":21,"paragraphs":22},"Hold the change without losing the legitimate invoice",[23,24],"A supplier-change check should separate the underlying invoice from the new payment instruction. An invoice can describe real goods, the correct amount and a genuine purchase while the proposed beneficiary still needs verification. Keep the existing approved supplier details available and mark the new instruction as pending. This avoids silently replacing trusted data before anyone has confirmed the change.","Assign one person to own the pending update and identify any payment already scheduled against it. The purpose is to control the change, not automatically accuse the supplier or cancel legitimate work. If the deadline is close, tell the appropriate business owner why release is paused and which verification step is outstanding. Urgency needs a defined escalation route rather than an undocumented exception.",{"title":26,"paragraphs":27,"sources":30},"Use an established contact and confirm authority",[28,29],"The FBI's BEC guidance recommends independently verifying payment and account changes. For a business process, use contact details established before the questionable request. A number added to the new invoice, a replacement signature or a new chat contact belongs to the request being checked. It cannot independently establish its own legitimacy.","Confirm both the change and the person's authority to request it. A receptionist may verify that an employee exists without having authority over beneficiary details. Agree how the supplier's authorized contact and your own finance approver will confirm the proposed information using an appropriate secure channel. Do not read sensitive account information to an unverified incoming caller merely because they know the invoice number.",[31],{"label":32,"url":33},"FBI: business email compromise and independent payment verification","https:\u002F\u002Fwww.fbi.gov\u002Fhow-we-can-help-you\u002Fcommon-frauds-and-scams\u002Fbusiness-email-compromise",{"title":35,"paragraphs":36,"table":39},"Record the change so another approver can review it",[37,38],"Use a short verification register alongside the normal supplier record. It should explain what changed, how the contact was found, who confirmed authority and who can release the update. The register is an original workflow aid, not a bank validation service. It does not establish account ownership by itself or replace the bank's controls and the business's own finance requirements.","Keep the record proportionate and access-controlled. Staff need a way to see that verification is complete without copying full bank details into an open chat. Separate the person who edits supplier data from the person who authorizes payment where the team can support it. If staffing makes separation difficult, document the alternate check rather than pretend a second approval happened.",{"caption":40,"headers":41,"rows":45},"Supplier bank-change verification register",[42,43,44],"Decision field","Evidence to retain","Release condition",[46,50,54,58,62,66],[47,48,49],"Requested change","Supplier, invoice context and affected beneficiary field.","The actual change is clearly identified.",[51,52,53],"Trusted contact","Origin of the previously held contact information.","The request did not supply its own verifier.",[55,56,57],"Supplier authority","Authorized person and confirmation route.","The person may approve this type of change.",[59,60,61],"Internal approval","Finance owner and backup approver.","Business approval is recorded separately.",[63,64,65],"Payment state","Pending, scheduled or already sent.","The correct bank or workflow action is taken.",[67,68,69],"Final update","Owner, time and affected supplier record.","Payment uses the reviewed information.",{"title":71,"paragraphs":72,"example":75},"Do not substitute email checks or a small transfer for approval",[73,74],"Sender-domain checks help assess the sending environment, but they do not authorize a beneficiary. A message arriving from an expected account still needs the supplier-change process. Finance should not be required to interpret raw email headers as its sole fraud control. The administrator can investigate an account concern while the finance owner independently verifies the business instruction.","A small successful payment also does not establish that the intended supplier controls the destination or that the change is authorized. Treat payment testing, bank checks and business approval as separate decisions with their own limits. Do not ask staff to improvise a transfer as a shortcut. Follow the financial provider's supported process and the organization's defined authority for changing sensitive master data.",{"title":76,"text":77},"Illustrative example: a deadline and a changed signature","A fictional purchasing team receives a real invoice thread with a new beneficiary and a new callback number. The regular supplier contact is away. Finance uses the backup contact already recorded in the supplier file and holds the update until the authorized change is confirmed. The new signature is treated as part of the request, not independent evidence. This is a proposed workflow example, not a recovered fraud case.",{"title":79,"paragraphs":80},"If details were updated or money moved, branch the response",[81,82],"An unverified update with no transfer calls for controlling the supplier record and checking scheduled payments. A transfer already sent requires prompt contact with the genuine bank or payment provider. Explain the suspected fraud, provide the transaction reference through the provider's secure channel and follow its instructions. A technical enquiry is not the first dependency for that conversation.","Preserve the request, verification history and known payment status. Do not delay financial action while trying to prove whether a mailbox was compromised. If the email environment may be involved, assign a separate administrator to review it. Recovery prospects and reporting duties depend on the circumstances and jurisdiction; no technical provider can promise a successful bank recall from this guide.",{"title":84,"paragraphs":85},"Make the process workable during absence and busy periods",[86,87],"Review the route with finance and the people who maintain supplier data. Include deputies, time zones, staff departures and requests received outside the usual schedule. A short tabletop can reveal whether the team knows where trusted contacts are stored and who can authorize an exception. Test that handoff using fictional details rather than a live beneficiary change or deceptive message.","CyberFixCrew is an Israeli cybersecurity company serving businesses worldwide with practical Israeli technical knowledge. We can discuss business-email configuration, account permissions and related technical controls within an agreed scope. Payment approval remains with the business, and bank action stays with the genuine financial provider. We do not offer a fraud-recovery guarantee or present this technical guide as legal or banking advice.",[89,90,91,92,93],"Hold the beneficiary change and identify scheduled payments.","Use a supplier contact established before the request.","Confirm authority as well as the exact proposed change.","Record separate internal approval and the final update owner.","If funds moved, contact the genuine financial provider promptly.",[95,98,101],{"question":96,"answer":97},"The invoice is genuine. Can the bank change still be fraudulent?","Yes, the invoice context and the proposed beneficiary are separate decisions. Keep the new instruction pending until independently verified.",{"question":99,"answer":100},"Is replying to the existing thread enough?","No, that keeps verification inside the channel being questioned. Use a previously trusted contact and the established approval process.",{"question":102,"answer":103},"Should we wait for an IT investigation before calling the bank?","No: if funds were sent to a suspected fraudulent destination, contact the genuine financial provider promptly and run the technical investigation separately.",[105,108,111,114,117,119],{"path":106,"label":107},"\u002Fglossary\u002Fbec","Understand business email compromise",{"path":109,"label":110},"\u002Fblog\u002Fdeepfake-payment-call","Verify voice or video payment requests",{"path":112,"label":113},"\u002Fblog\u002Fmicrosoft-365-account-compromise","Handle a suspected Microsoft 365 mailbox incident",{"path":115,"label":116},"\u002Fblog\u002Fbusiness-phishing-exercise","Rehearse the reporting and approval handoff",{"path":13,"label":118},"Discuss business mailbox controls",{"path":120,"label":121},"\u002Fservices\u002Faccess-2fa-audit","Review access and account ownership",[123],{"label":32,"url":33},{"title":125,"description":126,"button":127,"type":128},"Review the email and access controls around sensitive requests","Describe the technical concern and which systems are involved. For money already sent, contact the genuine bank or payment provider first.","Discuss business-email controls","check",[130,139,147,154],{"id":131,"path":132,"title":133,"description":134,"category":135,"artwork":136,"order":137,"publishedOn":138},"P086","\u002Fblog\u002Fqr-phishing-check","How to spot QR code phishing without opening the destination","Assess unexpected QR codes, trusted destinations and cross-device risks. Separate scanning, opening, signing in and granting access when reporting an event.","access","integrations",37,"2026-07-30",{"id":140,"path":141,"title":142,"description":143,"category":135,"artwork":144,"order":145,"publishedOn":146},"P191","\u002Fblog\u002Fidentify-phishing-message","How to identify a phishing message before taking action","Check the requested action, sender, destination and independent verification route. Learn what polished messages and familiar threads cannot establish.","email",49,"2026-08-29",{"id":148,"path":109,"title":149,"description":150,"category":135,"artwork":151,"order":152,"publishedOn":153},"P087","Deepfake voice payment scam prevention for business teams","Verify urgent voice and video payment requests through trusted contacts and approval rules. Build a process that does not depend on spotting fake audio.","support",32,"2026-07-16",{"id":155,"path":156,"title":157,"description":158,"category":135,"artwork":159,"order":160,"publishedOn":161},"P116","\u002Fblog\u002Fphishing-link-clicked","Clicked a phishing link? Choose the response by what happened","Separate a link visit from password entry, MFA approval, app consent and software installation. Report clearly and choose account, device or payment response.","security",28,"2026-06-30",[],null,{"path":165,"label":166},"\u002Fresources","Website security resources and templates",{"path":168,"label":169},"\u002Fglossary","Cybersecurity glossary for small businesses",1794134059126]