The rule for payment changes
- Stop any bank-detail change or unusual transfer until it is independently confirmed.
- Call a number already in trusted supplier or internal records; never use contact details in the request.
- Record a second approver for material payments and an exception path that does not bypass verification.
- If money moved, contact the originating bank immediately.
Last updated: September 25, 2026
A convincing email, text, voice or video does not authorize a transfer. FBI IC3's BEC guidance recommends verifying account changes through a secondary channel and contacting the bank promptly when fraud is recognized. The deepfake guide explains why media authenticity alone is a weak decision rule. This page is the procedure finance can practice.
The four-step verification procedure
- Pause the transaction. Flag new payees, altered bank details, unexpected urgency, changed payroll instructions and requests to bypass a normal approver. Keep the request and its metadata.
- Retrieve a trusted contact. Open the number from the supplier record, existing contract or approved internal directory. Do not use the email signature, message link, attached invoice or caller-supplied number.
- Confirm the exact change. Ask the known contact to state the account change or payment details in a fresh conversation. If the person cannot be reached, hold the transaction; urgency is not a substitute.
- Get independent approval and record it. A second authorized person checks the request, callback result and payment details. Log the decision and any exception owner before release.
| Request | Trigger | Verification record |
|---|---|---|
| Supplier bank change | New routing or beneficiary data | Known-number callback, person and time |
| Executive urgent transfer | Off-cycle or bypass request | Internal callback and second approver |
| Payroll redirect | New employee account details | Established HR identity workflow |
| Account recovery or vendor access | New admin or support contact | Existing help-desk and sponsor process |
Make the process usable on a busy day
Store verified supplier contacts outside invoice attachments. Give finance authority to delay a transfer without penalty when verification fails. Define a backup approver and a route for weekends or travel. Test the process with an authorized simulation before rolling it out. Review bank-detail changes, exceptions and false alarms monthly with finance and IT. The email security guide covers mailbox MFA and sender authentication, which complement but do not replace this rule.
If a fraudulent payment may have happened
Contact the originating bank immediately to request its recall or reversal process. Preserve the email, headers, phone details, approval trail and transfer information. Notify the incident lead and follow the BEC response guide. IC3 asks victims to file a detailed complaint; use case-specific advice for any other reporting duties. Do not promise fund recovery or delay bank contact while investigating whether a voice recording is synthetic.
Training prompt
Have a staff member practice saying: “I can process this after I call the number we already have and get the second approval.” The rule applies even when the request appears to come from the CEO.
Sources checked September 25, 2026: FBI IC3 BEC guidance and FTC small-business phishing guidance. This is a process template, not proof that any particular request is authentic.