Before You Pay That Invoice: A Small-Business Guide to Safer Payment Changes

The invoice looks familiar. It includes the right supplier name, a recognizable project description, and an amount your business expected to pay. The email even appears in an ongoing conversation.

There is just one change: the supplier says its bank account details have been updated.

For a busy employee trying to clear invoices before a deadline, that request may seem routine. But a convincing payment-change request can be part of a business email compromise scam, in which criminals impersonate a trusted contact—or use a compromised account—to redirect a legitimate payment. The FBI recommends independently verifying changes to account numbers or payment procedures before sending money. - Opens in new window

As businesses head into year-end purchasing, invoice reconciliation, and holiday absences, now is a good time to make that verification process clear. The objective is not to make every payment difficult. It is to make sure a believable message cannot quietly change where your money goes.

A Real Invoice Can Still Lead to a Fraudulent Payment

Invoice fraud does not always involve an obviously fake bill.

Sometimes the invoice is legitimate, but the payment instructions have been altered. A criminal may impersonate a supplier, use a look-alike email address, or gain access to a real mailbox and insert new banking details into an existing exchange. The request can appear to come from someone your employees already know.

Consider this illustrative scenario:

Your company is preparing to pay a contractor for completed work. A message arrives saying the contractor recently changed banks and asks you to use an attached form for the upcoming payment. The sender knows the invoice number and payment amount.

Those details make the request convincing, but they do not independently confirm that the bank change is legitimate.

That distinction matters: confirming that your business owes the money is not the same as confirming where it should be sent.

Treat Payment Changes as a Separate Approval

A useful safeguard is to separate invoice approval from payment-detail changes.

An employee may be authorized to confirm that work was completed or approve an invoice within a spending limit. That should not automatically mean they can change a supplier’s bank account without additional verification.

Create a documented process for requests involving:

• New bank account or routing details.
• A change in the payment recipient.
• A request to use a different payment method.
• An unusual advance payment.
• Instructions to send funds somewhere different from the approved vendor record.

The FTC recommends clear procedures for approving purchases and invoices - Opens in new window, while the FBI advises verifying vendor payment changes and considering a two-step verification process for wire transfers - Opens in new window.

The central rule is simple: a change in payment destination deserves a separate check, even when the invoice itself is approved.

Verify Through a Channel You Already Trust

Replying to the same email thread is not independent verification. If an attacker controls the mailbox or is impersonating the sender, they can simply reply that the change is correct.

Instead, call an established supplier contact using a phone number already in your approved records—not a number supplied in the payment-change email, its attachment, or an updated signature. The FBI specifically recommends using previously known numbers when verifying payment instructions by phone. - Opens in new window

During the call, confirm that the supplier requested the change and follow your organization’s approved process for validating the new details.

A practical workflow might be:

1. Pause the payment and leave the existing vendor record unchanged.
2. Contact the supplier through a previously established number.
3. Verify the requested change with an authorized contact.
4. Record who completed the verification and when.
5. Obtain the required internal approval before updating the record or releasing funds.

If you cannot reach the appropriate person, escalate the request internally. A missed connection is a reason to hold the change—not to assume it is legitimate.

Make Second Approval Meaningful

A second reviewer can help prevent a single convincing message from triggering a costly mistake. The FBI recommends considering a secondary sign-off for vendor payment changes. - Opens in new window

However, two people reading the same email is not necessarily a strong control. The second reviewer should confirm that the required independent verification actually occurred.

Depending on the size of your business, a workable arrangement could separate:

• The person requesting or entering the vendor change.
• The person reviewing the verification record.
• The person authorized to release the payment.

Smaller organizations may need a simpler structure, such as an accounting employee preparing the change and the owner approving it after reviewing the callback documentation. The important point is that the second approval adds a real check rather than another click.

Do Not Let Urgency Override the Process

Fraudulent requests often try to make normal verification feel inconvenient. A message may claim that payment must happen immediately, a supplier will stop service, or a senior executive has already approved an exception.

The FBI identifies pressure to act quickly and attempts to bypass normal procedures as warning signs in business email compromise schemes. - Opens in new window

Give employees explicit permission to pause a payment when something does not match the established process. A useful internal message is:

“Verification is required for payment changes, regardless of who requests them or how urgent they appear.”

Leadership needs to follow that rule, too. If employees routinely see executives bypass controls, it becomes harder to distinguish a legitimate exception from an impersonation attempt.

Arrange Coverage Before People Take Time Off

Year-end leave should not force employees to improvise approval authority.

Before key accounting staff, managers, or owners are away, document:

• Who can verify supplier changes.
• Who serves as the backup approver.
• Which transactions require additional review.
• How an unresolved request should be escalated.
• What happens when an authorized approver cannot be reached.

Provide backup approvers with access through their own authorized accounts rather than sharing another employee’s credentials.

This is a practical way to keep your existing controls working during absences—not an invitation to relax them so invoices can move faster.

Technology Helps, but It Does Not Approve the Payment

Email security, multifactor authentication, and account monitoring can help reduce the risk of account compromise. The FBI recommends MFA and cautions that criminals may use convincing messages and compromised accounts to carry out payment fraud. - Opens in new window

But a security tool cannot reliably determine whether your supplier genuinely changed banks. That business decision still requires an approved verification process.

IT, finance, and leadership have different responsibilities:

• IT helps protect accounts, investigate suspicious messages, and respond to signs of compromise.
• Finance verifies vendor details and follows payment controls.
• Leadership defines approval authority and supports employees who pause questionable requests.

The strongest approach combines technical safeguards with a process employees can consistently follow.

If a Payment Has Already Been Sent, Act Immediately

If you discover that funds may have gone to a fraudulent account, do not wait for a complete internal investigation before contacting your bank.

The FBI’s Internet Crime Complaint Center (IC3) recommends immediately contacting the originating financial institution to request a recall or reversal and any necessary supporting documentation. Rapid action may improve the chance of recovering funds, but recovery is not guaranteed. File a complaint with IC3 - Opens in new window as soon as possible, including the relevant banking and transaction information.

At the same time:

• Notify the appropriate internal decision-makers.
• Engage your IT or security partner to assess possible account compromise.
• Preserve relevant messages, invoices, attachments, and transaction records.
• Follow applicable legal, insurance, and contractual notification procedures.

Do not continue relying on the suspected email exchange to resolve the issue. Use independently verified contacts for the supplier, bank, and other involved parties.

Build a Process People Can Use

Payment controls work best when they are clear enough to follow during a normal workday—not just when everyone has time to scrutinize every message.

Start with a short written procedure. Explain what triggers verification, which contact information employees should use, who approves changes, and where the verification is recorded. Then walk through a realistic example with the people who handle invoices and vendor records.

The FTC advises businesses to make invoice-approval procedures clear and ensure employees check invoices closely. - Opens in new window Turning those expectations into a repeatable workflow makes them easier to apply.

Conclusion

A familiar supplier name, a genuine invoice, and a convincing email are not enough to authorize a new payment destination.

Before changing banking details or sending money under unusual instructions, verify the request through a trusted, independent channel. Pair that check with meaningful approval requirements and clear backup responsibilities so busy periods and employee absences do not weaken the process.

If your business wants to strengthen the technical protections supporting its payment workflows, contact ExcalTech. Working alongside your finance and leadership teams, ExcalTech can help review email and account-security safeguards so your employees have a stronger foundation for making safe payment decisions.