A genuine-looking thread does not approve payment
Finance receives a message in an existing conversation: “We changed banks; please use the account in the attachment.” The name, signature and order number look familiar. That is not enough to approve a change. An attacker may impersonate the supplier or use an actual compromised mailbox.
Business email compromise does not require malware or obvious spelling mistakes. The control therefore needs to protect the payment decision itself. A bank-change message starts verification; it does not complete it, even when the sender appears to be an important customer.
Confirm through an independent channel
Call a known contact using a number already held in an approved supplier record. A number in the suspicious message, its signature or a new attachment is not an independent source. Ask the contact to confirm the change and identify the responsible person at their organisation.
If the contact cannot be verified, pause the change and escalate it. Document who may approve an exception and what additional evidence is needed. Replying to the same email or receiving another “confirmation” within that thread does not resolve the uncertainty.
Separate record changes from payment approval
Use a simple workflow: one person records the request, another checks independent confirmation and approves the new account. At payment time, compare details with the approved supplier record, not just the newest PDF. Record the date, contact person and verification method.
In a very small company, the owner may provide the second check, but should not merely click approval under time pressure. They need to see what changed and how it was confirmed. Apply the same rule when a long-standing, trusted supplier requests new payment details.
Plan for urgency and absent approvers
Practise a Friday-afternoon scenario: a supplier demands immediate payment while the approver is away. Without a deputy, staff may improvise a shortcut. Establish an alternative approver and permission to delay payment until the issue is resolved.
Do not build the procedure around recognising the director’s voice or writing style. Requests for secrecy, bypassing checks or moving to another communication channel deserve scrutiny. Employees must be able to ask for independent confirmation without being punished for delaying a suspicious transfer.
If the transfer has already been sent
Do not wait for the internal investigation to finish. Contact the bank through an official channel and report suspected fraud with the transaction details. The bank can explain available actions; do not assume the funds are recoverable. Notify the incident owner and protect further payments connected with the matter.
Preserve the original message with headers, attachment, approval history and payment confirmation. Avoid forwarding the suspicious attachment widely. Base further reporting and communication with the supplier on confirmed facts and the appropriate response procedure.
Review both the mailbox and the process
If account compromise is possible, the administrator examines sessions, authentication methods, forwarding rules and application access. Securing the mailbox is a separate task: stopping a payment does not remove an intruder. Check whether similar instructions reached other people.
Afterwards, reconstruct the decision path. Did the supplier record contain a reliable telephone number? Did the second person see the account change? Did bank authorisation include a comparison of payment details? Choose a specific process improvement and test it with an example rather than ending with a general request to be more careful.
Sources: FBI — Business Email Compromise · DfE Cyber Security Hub — Business email compromise playbook · USAID OIG — Business Email Compromise Scheme