Field guide / phishing response
A supplier changed bank details. Verify outside the message.
Independent verification is a control; familiar branding is not.
Pause the requested change
An urgent instruction in a familiar thread does not establish that a new destination is authorised. Do not change supplier records or send a test payment based only on that message. Follow your finance approval process. This guide does not validate banking details, determine liability or replace your bank’s advice.
Use an independently known contact
Contact the supplier using verified details already held in your records or another independently established route. Do not use the new phone number in the email signature or attachment. Confirm the requested change through your approved process. If a trusted contact cannot be established, keep the change unresolved rather than treating urgency as proof.
Separate verification from authorisation
Record who verified the request, when and through which established channel. Apply any required second approval before changing supplier records or releasing funds. A callback note does not override finance policy. Keep private banking information in the approved system rather than a widely shared checklist.
Worked example: real invoice, false destination
A genuine supplier invoice is followed by a bank-detail change in an ongoing thread. The invoice number and amount match real work. Those details still do not establish that the change is genuine: a mailbox or conversation may be compromised. A known-contact check pauses the payment while finance and the supplier investigate.
If the payment already happened
Contact the bank or payment provider immediately through its official route and explain the suspected fraud. Ask what protective or recovery steps are available. Notify finance and security contacts and follow local reporting procedures. Do not wait for the sender to reply, assume a recall will succeed or send more money to a service promising recovery.
Sources and scope
Source guidance informs the actions above. Explanations and worked scenarios are original. Provider controls and reporting routes vary; follow your provider and employer’s instructions.