What a changed invoice can conceal
A supplier invoice arrives. The project is familiar and the amount looks reasonable. Only the bank account has changed. That change deserves its own check. Business email compromise, or BEC, uses business communications to induce fraudulent payments. The FBI describes attacks carried out through genuine accounts that criminals have taken over.
A familiar display name, a correct signature and an existing conversation therefore do not authorise a payment. A well-written message can still contain fraudulent bank details. The useful question is who has confirmed the change independently of that message. [1]
Verify through a contact you already know
Call the responsible person using a number already held in your records. Use neither the new number in the message nor a contact reached through its links. Replying in the same email thread only establishes that someone can operate that mailbox.
Check the beneficiary, bank details and invoice concerned. If the change cannot be confirmed, hold the payment. A threatened delivery delay or an instruction described as especially confidential should not bypass this step. The FBI recommends an additional verification channel for changes to payment information. [1]
Keep an approval record that people can use
We recommend one change record shared by purchasing and finance. Store it with the supplier or invoice record, rather than only in an employee's inbox. The second reviewer should examine the independent confirmation instead of simply reading the same email again.
- Record the supplier, invoice reference and requested change.
- Record the established contact and the time of the verification.
- Compare the confirmed bank details with the proposed payment.
- Identify the reviewer and approver under your dual-approval procedure.
- Update supplier details only after confirmation and check the first payment again.
What if the money has already been sent?
Contact your bank immediately through its official contact channel and report the suspected fraud. Ask about stopping or recalling the payment. Recovery is not guaranteed. At the same time, inform the responsible IT team and the genuine business contact through a reliable channel.
Keep the original messages and payment records. Cybermalveillance also recommends documenting suspicious forwarding rules before changing them. Arrange an investigation into possible mailbox access and report the fraud to the relevant authority. [2] [3]
Domain protection and payment approval work together
SPF, DKIM and DMARC help assess the sender domain used in a message. They do not confirm that an invoice is correct or authorise a bank-detail change. A compromised genuine account or a lookalike domain remains a different route for fraud.
It is therefore useful to check your email configuration and establish reliable approval for payment changes. The related guide to SPF, DKIM and DMARC explains which evidence to request from your IT team. Keep that technical review alongside the documented payment process.
Where a Cyberkern assessment fits
A Level 1 external security assessment can examine the agreed domain and email configuration and prioritise concrete technical measures. Your finance team remains responsible for payment approvals; suspected mailbox compromise should be investigated by the responsible IT team. For an enquiry, prepare your domains and the email services you use. Do not include credentials or invoice attachments in the initial contact form.
Related reading
Sources & further reading
Published:
Primary sources checked on 02.10.2026.
Sources and limitations are identified in the article.