Treat every change as unverified
A familiar email thread, signature, invoice or urgent message does not prove that new bank details are genuine. Pause the payment process whenever the beneficiary name, bank, account, currency or payment route changes.
- Do not reply only within the change email
- Do not use contact details supplied in that message
- Do not allow urgency to bypass approval controls
Use an independent channel
Verify the complete instruction with an established contact using a telephone number or channel already held in trusted records. Record who verified the change, when, through which channel and exactly what was confirmed.
- Confirm legal beneficiary and account ownership
- Use dual approval for material payments
- Compare contract, invoice and bank details
- Preserve the verification record
Act immediately after a mistake
If a suspicious payment has been sent, contact the sending bank immediately and request a hold, recall or fraud escalation. Preserve messages and payment records, notify the genuine counterparty through a trusted channel and report to relevant authorities where appropriate.
- Speed materially affects recovery prospects
- Do not alert an attacker before bank guidance
- Review other accounts and credentials for compromise