Business Payment Change Verification: A Playbook for Fake Invoice and BEC Scams

Overview

Fake invoice scams and business email compromise (BEC) usually exploit trust rather than a technical weakness. An attacker may impersonate a supplier, executive, employee, or customer and request that an invoice be paid to a new account. The message may arrive by email, text, phone, collaboration platform, or a compromised vendor account.

The safest response is not to judge a request by its writing quality or by the apparent identity of the sender. Instead, separate the payment request from the verification process. Confirm the request through a trusted, independent channel, require the right approvals, and preserve enough evidence to explain why the payment was released.

These controls should apply even when the request appears to come from a senior executive or a familiar supplier. Urgency, confidentiality, travel explanations, and claims that a normal process is unavailable are not substitutes for verification. For related checks, see the Business Email Compromise and Fake Invoice Prevention Checklist and the Vendor Verification Checklist.

Checklist by scenario

1. A new vendor or supplier is being added

• Confirm the legal or trading name, physical address, normal contact details, and expected services using records obtained independently of the request.
• Use a trusted company website, existing contract, previous invoice, or known contact to reach the supplier. Do not rely only on contact details supplied in a new email.
• Match the proposed vendor to a purchase order, contract, onboarding record, or internal business owner.
• Require a second employee to review the onboarding information before the vendor can receive payment.
• Record who performed the checks, when they were completed, and what evidence was reviewed.

2. Bank details or payment instructions have changed

• Pause the change. Do not treat an amended invoice, reply email, or attached letter as sufficient proof.
• Call a known number already stored in your vendor record, not a number in the change request.
• Ask the supplier to confirm the change and the effective date. Avoid leading questions that reveal the new account details before confirmation.
• Have the employee who requested or received the change remain separate from the employee who approves it in the payment system.
• For higher-risk payments, obtain confirmation from two authorized contacts or use a documented callback procedure.
• Keep the old details available for comparison, but do not copy them forward automatically if the account change is approved.

3. An invoice is urgent, overdue, or inconsistent

• Match the invoice to the purchase order, delivery record, contract terms, and expected amount.
• Investigate changes in bank details, sender address, invoice numbering, tax information, formatting, currency, or payment deadline.
• Ask the budget owner to confirm that the goods or services were requested and received.
• Reject pressure to bypass approval, split a payment, use a personal account, or conceal the transaction from colleagues.
• Send suspected fraudulent invoices to the designated security or finance contact without forwarding them broadly.

4. An executive or employee requests an unusual payment

• Verify the request by calling the person through a known number or speaking face to face. Do not use the email thread, supplied number, or a link in the message as the only channel.
• Confirm the purpose, recipient, amount, deadline, and approval path.
• Apply the normal authorization rules even if the sender claims to be traveling, unavailable, or handling a confidential matter.
• Ask the requester to approve the transaction through the established system rather than by informal email alone.
• Escalate calmly when the request conflicts with policy. A legitimate executive should not object to a reasonable anti-fraud control.

5. A vendor account or mailbox may be compromised

• Stop relying on the affected email conversation until the vendor confirms control of the account through another channel.
• Contact the supplier using an established relationship owner or previously verified number.
• Review recent invoices, payment changes, login notifications, and other unusual requests connected to the account.
• Notify finance, security, and the vendor’s known contact according to the organization’s incident process.
• If money has already been sent, contact the bank or payment provider promptly and preserve messages, headers, invoices, approvals, and transaction details.

What to double-check

A verification call is useful only when it is independent. A phone number copied from the suspicious email, a link in the same message, or a reply to the same compromised mailbox does not provide meaningful separation. If you are unsure whether a sender or contact detail is genuine, use the checks in How to Check a Suspicious Phone Number, Email, or Sender Before Responding.

Review the full payment context, not just the requested account number. Check whether the vendor name, invoice amount, purchase order, delivery status, payment currency, and account ownership all make sense together. A technically valid account can still belong to an unauthorized recipient.

Use least privilege in payment systems. The person who enters a vendor or bank-detail change should not be the only person who can approve and release a payment. Configure approval thresholds, dual authorization, alerts for changed beneficiaries, and an audit trail where those features are available. Controls should support the workflow rather than encourage staff to bypass it.

When a message contains a link or attachment, do not open it merely to verify the request. Use a known portal or contact the organization directly. These guides cover checking a link before clicking and verifying a suspicious website.

Common mistakes

• Trusting the display name: A familiar name does not prove that the underlying address or account is authentic.
• Relying on caller ID: Caller ID and message sender information can be misleading. Use a trusted callback route.
• Treating a small change as low risk: A minor invoice edit or account update can be a test before a larger request.
• Allowing urgency to override controls: A deadline is a business consideration, not evidence that a request is legitimate.
• Using one person for every step: Combining vendor setup, invoice approval, and payment release removes useful separation of duties.
• Deleting suspicious messages: Preserve relevant evidence and report it through the organization’s process so others can be warned.
• Assuming internal accounts are safe: A real employee or supplier mailbox may be compromised. Identity and request verification remain necessary.

When to revisit

Review this payment-change process before seasonal planning cycles, staffing changes, acquisitions, new banking arrangements, accounting-system migrations, or periods when approval coverage changes. Revisit it whenever vendors, payment tools, remote-work practices, or communication platforms change.

Run a short tabletop exercise at a practical interval: present finance and operations staff with a realistic bank-detail change or executive payment request and ask them to explain exactly how they would verify it. Update callback numbers, approved contacts, escalation routes, approval limits, and system instructions when the exercise exposes uncertainty.

Keep a printable version of the following minimum checklist near the payment workflow:

1. What changed: vendor, invoice, recipient, bank account, amount, deadline, or approval?
2. What independent source confirms the request?
3. Who completed the callback or other verification?
4. Does the request match the contract, purchase order, delivery record, and payment history?
5. Has a separate authorized person reviewed and approved it?
6. Are the evidence and decision recorded?
7. If anything remains unusual, has the payment been paused and escalated?

When the answer to any critical question is unclear, pause the payment rather than guessing. For suspected phishing or a compromised account, follow the organization’s incident process and use the account recovery and fraud response plan if someone has interacted with a malicious message.