A changed bank account is not just an email: preventing invoice fraud

When a familiar vendor asks you to send money to a new account, the invoice may be legitimate while the instructions are not. A simple verification rule can close that gap.

Why familiar invoices are still worth verifying

A vendor sends an invoice. The amount looks right, the project name is familiar, and the email thread contains months of ordinary correspondence. Then comes a short note: “We changed banks. Please use the new account on this invoice.”

That is a routine business request, but it is also a common opening for business email compromise (BEC), a form of fraud in which criminals impersonate or take over legitimate business communications to redirect payments. The FBI's Internet Crime Complaint Center describes BEC as targeting people who make legitimate transfers of funds.

The critical point is that an invoice can look convincing without the payment instructions being legitimate. The fraud may involve a lookalike email address, a compromised mailbox, a forged invoice attachment, or an attacker replying inside a real conversation.

Treat a change in payment destination as a separate approval

Most offices already review invoices for amount, date, vendor, and whether work was performed. That review is necessary, but it answers a different question: Should we pay this bill?

Changing the destination of the payment requires its own answer: Are these the correct banking details for the intended recipient?

Those questions should not be combined. A legitimate invoice with fraudulent account details can pass an ordinary accounts-payable review. A good policy makes bank-account changes an exception that triggers verification before money moves.

This applies to changes requested through email, PDFs, text messages, online portals, or phone calls. The format of the request is not proof of its origin.

Verify using a channel you already trust

The FBI recommends using a secondary channel to confirm requests to change account information. For a small business, the practical version is straightforward: call the vendor using a phone number already on file from a trusted prior record, not the number included in the change request.

Ask an established contact to confirm the new payment instructions. If the person answering cannot verify the change, pause the payment until someone authorized can.

Do not treat a reply to the same email thread as independent verification. If that mailbox or conversation has been compromised, the attacker may receive and answer the reply. Similarly, a phone number printed on the newly supplied invoice may route directly to the impersonator.

When a known contact is unavailable, use a previously established business contact method or another independently verified route. Document who confirmed the change, when, and through which channel.

Create a simple approval rule

A small business does not need a complicated finance department to control this risk. It needs a rule employees can follow without improvising.

For example: any new or changed vendor bank details must be verified by a person other than the requester, using a trusted contact method, before the payment record is updated. The person entering new banking details should record the verification.

For higher-value payments, consider requiring a second internal approver. Set the threshold based on your actual business exposure rather than borrowing a number from another company. The goal is to prevent one convincing message from changing both the payment destination and the approval decision.

Do not allow urgency to override the process. “We need this paid today” is a reason to verify promptly, not a reason to skip verification.

Keep vendor records separate from incoming messages

The most useful accounts-payable record is one the organization controls. Maintain the vendor's established contact, approved payment method, account-change history, and who is authorized to approve changes.

That does not require storing full banking details in an unsecured spreadsheet. Use the payment platform's appropriate access controls and retain only the information needed to verify changes and maintain an audit trail.

Limit who can edit vendor payment destinations. If everyone who can open an invoice can also replace the bank account, a single mistaken click can have a larger consequence.

Review user access when staff change roles or leave. Our IT offboarding checklist covers the broader identity and access steps that should accompany a departure.

Understand what email security can and cannot do

Email authentication, filtering, and account protection reduce opportunities for fraud, but they do not replace payment verification. A criminal who controls a legitimate vendor mailbox may send a message that passes ordinary email authentication checks.

Use MFA on business email accounts, monitor suspicious sign-ins, and review unexpected forwarding rules or mailbox changes when compromise is suspected. Configure SPF, DKIM, and DMARC to help defend your domain against some forms of spoofing; our email authentication guide explains their roles and limits.

Those controls make attacks harder. The financial control is still the independent confirmation of changed payment instructions.

Teach employees what to do, not just what to spot

Training that says “watch for suspicious emails” is too vague for the person processing a stack of invoices at 4:30 p.m.

Give staff a concrete decision rule: if payment details change, stop and verify through a trusted channel. Make the escalation path obvious. Employees should know whom to contact when a vendor insists that a transfer is urgent or a manager asks them to bypass the rule.

Also make it acceptable to delay a payment briefly while verification occurs. A procedure that exists on paper but is routinely overridden by pressure is not an effective control.

The FTC's small-business scam guidance likewise emphasizes clear invoice approval procedures and employee awareness of impersonation and urgency tactics.

What to do if the payment already went out

If you suspect money was sent to the wrong account, act immediately. Contact the sending financial institution, explain that the transfer may be fraudulent, and ask whether it can initiate a recall or other recovery action. The available options depend on the payment method, timing, and financial institutions involved.

Preserve the original messages, invoice, account details, transfer confirmation, and related records. Report the incident to the FBI's Internet Crime Complaint Center. If an email account may have been compromised, involve the person responsible for your IT security to secure accounts, review sign-in activity and forwarding rules, and determine whether other messages or payment requests were affected.

Do not wait for a complete internal investigation before contacting the bank. The FBI stresses that speed matters when attempting to recover funds.

A 15-minute policy to put in place this week

Write down one rule and make sure everyone who pays invoices knows it:

• Flag any new or changed payment instructions.
• Verify the change with a known contact through a previously trusted channel.
• Record who confirmed it and when.
• Require additional approval for payments above your chosen threshold.
• Restrict who can edit vendor payment records.
• Escalate any request to bypass the process.
• Contact the bank immediately if a fraudulent payment is suspected.

Test the procedure with one recent vendor change. Can you show who verified it, which number they used, and who approved the update? If not, that is a useful place to start.

For tax and accounting firms, the same principle applies to requests involving client funds, payroll changes, or sensitive financial information. Procedures should be adapted to the firm's actual workflows and any applicable obligations; they are not a substitute for a broader written information security program.

The important distinction

Good cybersecurity protects the channel through which a request arrives. Good business process verifies the action being requested.

Both matter. Even a well-secured email environment cannot establish that a newly supplied bank account belongs to the vendor you intended to pay. A short, repeatable verification step can prevent an ordinary administrative change from becoming an expensive mistake.

Authoritative guidance

• FBI IC3: Business Email Compromise
• FBI IC3: Business Email Compromise Advisory
• FTC: Scams and Your Small Business