Never act on a bank detail change from the email that requested it. Confirm it through a second channel you already trust, such as a phone number from your vendor records, and require a second person to approve the change. That one rule defeats most payment redirection fraud.
Why email alone cannot be trusted
A request can come from a lookalike domain, a forged display name or a genuinely hijacked mailbox. In the last case the sender address is correct and the thread is real. Your eyes cannot settle it.
CISA's phishing guidance gives the right instinct: do not use any link or number in the message. Contact the company through its verified website, or reach the person by a different method you already trust. The FTC says the same for account and payment updates.
The checklist
- Treat every change as a request, not an instruction. New account number, new bank, new remit-to name, new payment portal, all count.
- Look up the contact yourself. Use the phone number in your vendor master record or the signed contract, not the one in the email or a new signature.
- Call and ask the vendor to read the details back. Do not read your copy to them first.
- Record who you spoke to, when, and the number used. This is the audit evidence.
- Require a second approver who did not take the call. One person should not be able to both verify and release.
- Hold the first payment to a changed account for a short, defined delay, if your process allows it.
- Send a small test amount or confirm with the bank where that is routine for you.
- Warn the vendor about the incident if the request looks fake, since their mailbox may be compromised.
Design it into the system
Engineers can make the safe path the easy one.
- Lock vendor bank fields so edits need a ticket with the verification record attached.
- Block edits that arrive through a shared inbox with no ticket.
- Alert finance when a vendor record changes within a short period after an email thread mentioning payment.
- Log who approved, from where, and from which account.
None of this needs new tools. A form, a required field and a second pair of eyes are enough to start.
Red flags worth noting
CISA lists urgent or emotional pressure, requests for financial information and incorrect addresses or links among the signs of phishing, and warns that perfect grammar proves nothing. In payment cases, add a sudden change of bank, a request to keep the matter quiet and pressure to pay before a deadline.
Quick check
Is it enough to reply to the email and ask if it is really them?
No. If the mailbox is compromised, the attacker answers. Use a separate channel and a contact you already hold.
Who should own this process?
Finance owns the policy, and engineering owns the controls in the vendor system and mail platform. Both should sign off on the written procedure.
Sources
Last reviewed: 19 October 2026.
