A plausible invoice, familiar email thread and correct project details do not authenticate new payment instructions. The control must leave the possibly compromised channel.
An accounts team receives an updated invoice minutes before a scheduled deposit. The beneficiary name has changed slightly, the bank is in another jurisdiction and the sender says the old account is ‘under audit’. The email sits inside a genuine conversation and quotes the correct purchase-order value. Those details can make the request feel safer, but business email compromise can use hijacked accounts and real transaction context. The payment should enter an exception hold until the organisation verifies the change through a previously trusted route and completes its own bank, legal, sanctions and approval checks.
1. Treat any beneficiary change as a new control event
Do not pay, edit the vendor master or reply with confidential information merely because the request looks authentic. Place the affected payment and master-data change on a visible exception hold. Preserve the original message with headers and attachments under the organisation's incident procedure; do not click unexpected links or use contact details embedded in the request.
Compare the request with the controlled baseline: contracting entity, approved payee, beneficiary name, account and bank country, currency, invoice and purchase-order references, sender domain, prior payment pattern and authorised change process. Record differences exactly. Urgency, secrecy, a last-minute platform change, a lookalike domain, a new country, a personal account or a refusal to speak are escalation signals—not proof of fraud by themselves.
The FBI describes business email compromise as a scheme that can use spoofed or compromised accounts and genuine-looking requests. Its current public guidance specifically tells businesses to verify account-number or payment-procedure changes with the person making the request, and to use a company number found independently rather than a number supplied in the suspicious message.
| Field | Controlled record | Hold trigger |
|---|---|---|
| Existing baseline | Last independently verified vendor-master record and approval | No reliable baseline |
| Requested change | Old/new beneficiary, bank, country, currency and effective invoice | Unexplained or incomplete difference |
| Message context | Original file/header, sender, reply-to, time and attachment hash where used | Lookalike or inconsistent routing |
| Commercial context | Contract, order, invoice, amount and due date | Unexpected amount or accelerated timing |
| Authority claimed | Named requester and stated capacity | Unknown or unverified authority |
| Current state | Held / escalated / verified / rejected | Any attempt to bypass the hold |
2. Build a genuinely independent callback
Use a contact route established before the change: a number in a controlled contract/vendor record, a known authorised representative reached from the organisation's address book, or a verified corporate switchboard sourced independently. Do not call the number in the change email, its attachment, signature block or a follow-up message. Do not treat a reply in the same email thread as an independent check.
Use a two-person process for significant or exceptional payments: one person conducts and records verification; another reviews the evidence and releases or rejects the master-data change under delegated authority. Separate master-data editing from payment release where the organisation's control design requires it. Authentication answers should not be disclosed in the suspect channel.
Ask the known contact to explain the requested change and confirm the exact contracting and beneficiary entities, authorisation path, effective invoices and official supporting record. Read back sensitive values according to the organisation's secure protocol rather than inviting an unstructured email repeat. A video call or familiar voice can add context but is not conclusive; accounts can be compromised and identities imitated.
| Control | Acceptable evidence example | Not independent |
|---|---|---|
| Contact source | Pre-existing controlled record or independently verified switchboard | Number in the change request |
| Person authority | Known role plus authorised delegate/approval evidence | Caller says ‘finance approved it’ |
| Change scope | Exact old/new fields and affected invoices read back securely | General ‘bank details are correct’ |
| Entity rationale | Documented commercial/legal relationship and authority | ‘Same owner’ or ‘our agent’ alone |
| Verifier | Named employee, time, route and contemporaneous notes | Unattributed tick box |
| Second control | Independent reviewer/master-data approval | Same person requests, edits and pays |
3. Reperform the checks affected by the change
Independent callback authenticates a communication; it does not by itself establish that the new payee is contractually entitled, legally valid or acceptable to the bank. Reconcile the contracting party, invoice issuer and proposed beneficiary. Obtain authorised amendments, assignments, agency/collection authority or other transaction-specific documentation where applicable, and have legal, tax, compliance and banking specialists assess it.
Refresh entity-registry, bank-country, sanctions/export-control, tax and fraud-risk checks to the extent required by law and organisational policy. Use official registers and trusted providers; preserve the date and search scope. A matching company name is not proof that an account belongs to it, while bank confirmation services may have jurisdictional and coverage limits. Ask the organisation's own bank what beneficiary checks are available and how results should be interpreted.
Update the vendor master only after the evidence package is approved. Retain the former value, effective date, change reason, requester, verifier, reviewer and affected invoices in an audit history. Never overwrite the prior account without traceability or reuse a verification indefinitely for later changes.
| Gate | Question | Disposition |
|---|---|---|
| Authenticity | Was the request confirmed through a pre-existing independent channel? | Pass / hold / reject |
| Authority | Can the named person and entity authorise this exact change? | Pass / legal review |
| Entitlement | Why may this beneficiary receive this invoice payment? | Pass / amendment or evidence required |
| Compliance | Are required sanctions, tax, bank-country and internal checks current? | Pass / specialist review |
| Master data | Were old/new values and approvals retained? | Pass / return |
| Payment | Does invoice, amount, currency and beneficiary match the released record? | Release / hold |
4. If suspicion remains—or money was sent—escalate immediately
If verification fails or compromise is suspected, keep the payment held, notify internal finance, security, legal and leadership routes, and contact the genuine counterparty through trusted channels. Preserve evidence; avoid tipping off a suspected attacker inside a compromised mailbox. Let the responsible security team address credentials, mailbox rules, sessions and wider exposure.
If funds have already been sent, contact the organisation's financial institution immediately using a trusted channel and request the bank's fraud/recall process. The FBI likewise advises immediate contact with the financial institution and reporting to IC3 for relevant US-linked incidents. Other jurisdictions have their own reporting routes. Recovery is time-sensitive but never guaranteed.
After containment, reconcile every invoice and master-data change exposed during the period, not just the discovered transfer. Record facts, decisions, bank references and reporting steps under access control. Improve the protocol—known contacts, dual control, exception alerts and staff exercises—without publishing security answers or sensitive beneficiary data.
FAQ
Is a reply from the supplier's usual email address enough?
No. A mailbox or thread may be compromised. Verify through a trusted route that existed independently of the change request.
Can we call the number printed on the new invoice?
That number belongs to the evidence under question. Use a previously controlled contact or an independently sourced and verified corporate route.
Does a successful callback mean the account is safe to pay?
Not by itself. Authority, entity entitlement, bank/compliance checks, master-data approval and invoice reconciliation still have to pass.
What if the payment is urgent?
Urgency increases the need for the control; it does not authenticate the change. Escalate the hold through the organisation's authorised exception route.
What should happen if money was already transferred?
Contact your own bank's fraud route immediately, preserve records and follow internal and jurisdiction-specific law-enforcement/reporting advice. Recall or recovery is not guaranteed.
Continue the project review
Connect this guide with the proposed window and door systems, then review how Cavorlen approaches manufacturing and quality control. When your schedule is ready, send it through the project review form.
Official sources used
FBI — Business Email Compromise ↗FBI — BEC warning on changed payment instructions and trusted contacts ↗FTC — Scams and Your Small Business ↗UK National Crime Agency — Invoice fraud campaign ↗ICC — Digital Standards Initiative: trade digitalisation and trusted data ↗Related buyer guides
This article is fraud-prevention and procurement-control education, not banking, payment, cybersecurity, legal, sanctions, anti-money-laundering, tax or law-enforcement advice. It does not determine whether any instruction is genuine, guarantee recovery, prescribe a bank process or state any Cavorlen payment method, bank account or change policy. Organisations must follow their bank's current instructions, applicable law, internal controls and authorised professional advice. Never publish or send sensitive bank details through an unapproved channel.