Business Email Compromise: How to Verify Urgent Payment and Vendor Change Requests

Overview

A BEC attempt may come from a compromised mailbox, a lookalike domain, or an account impersonating an executive, supplier, customer, or payroll contact. The message may appear in an existing conversation and use familiar branding, a copied signature, or details gathered from public information. Its defining feature is usually the requested action: send money, redirect a payment, change bank details, purchase gift cards, or disclose information under time pressure.

Urgency is not proof of fraud, but it is a reason to slow down. Treat any request that changes payment instructions or bypasses an established approval process as unverified until it has been confirmed through a trusted channel. Do not use the phone number, email address, reply chain, payment link, or QR code supplied in the suspicious message for that confirmation.

The safest approach is a two-channel workflow: preserve the request, independently locate a trusted contact method, confirm the details with the appropriate person, and obtain the required approval before acting. This process applies even when the request appears to come from a senior executive or a long-standing vendor.

Step-by-step workflow

1. Pause the transaction

Do not reply with confirmation, open unexpected attachments, click payment links, or update supplier records while the request is being assessed. If a deadline is mentioned, document it rather than allowing it to override controls. A legitimate requester should be able to tolerate a brief verification step.

2. Classify what changed

Identify the exact action requested and compare it with the normal process. Common high-risk changes include:

• A new bank account, routing detail, payment address, or beneficiary
• A request to pay an invoice earlier than usual or split it across accounts
• A demand to keep the transaction confidential or exclude a colleague
• A request to buy gift cards, cryptocurrency, or other unusual payment instruments
• A payroll change involving an employee’s account or personal details
• An executive request that does not follow the organization’s normal approval path

Read the actual payment details from a trusted record, such as a previously approved contract or vendor profile. Do not rely on a forwarded document or a newly supplied attachment alone.

3. Inspect the message without treating inspection as proof

Check the sender’s complete address, domain spelling, reply-to address, display name, message timing, and writing style. Look for mismatched domains, unexpected forwarding, unusual requests for secrecy, and pressure to act immediately. An account that appears familiar may still be compromised, so a correct address does not make the request legitimate.

For a suspected phishing message, avoid clicking links to inspect them. If your mail system provides safe message details, review the original headers or ask an administrator to examine them. Guidance on checking email, text, and QR-code phishing can help with the initial review.

4. Verify through a known channel

Contact the requester using information already held in your records. For a vendor, use the phone number in the existing vendor master file, a signed contract, or a previously verified invoice—not the number in the new email. For an executive, call or speak with that person using the company directory, an established internal messaging channel, or in person. For payroll, follow the documented employee-change process and confirm the request with the employee through a separately known channel.

Use a direct, neutral script: “I received a request to change the payment details for [vendor or employee] and send [amount or type of payment]. Before I process it, please confirm the account ending in [last four digits or approved reference] and the requested effective date through our standard process.” Do not read back full bank details in an unsecured conversation unless your procedures require it.

5. Require independent approval

Verification and approval should be separate controls. The person who receives or enters the request should not be the only person who authorizes the payment. Use the organization’s approval matrix and require a second reviewer for new beneficiaries, changed account details, unusual amounts, urgent exceptions, or requests that bypass normal purchasing.

Record who confirmed the request, which trusted channel was used, what details were verified, and who approved the transaction. If the requester cannot be reached, the details conflict, or the request remains unusual, hold the payment and escalate it to the finance or security contact.

6. Report and contain suspicious activity

Forward suspicious messages according to your organization’s reporting process, preferably as an attachment or through the mail system’s reporting tool so technical details are preserved. Do not delete the original before it is captured. If credentials may have been entered, report that immediately, change the affected password from a trusted device, and review active sessions and multifactor authentication settings.

If money has already been sent, contact the financial institution and the organization’s incident contact without delay. Preserve messages, invoices, payment records, headers, call notes, and timestamps. The security alert triage guide offers a related process for handling warnings from email, banking, and other accounts.

Tools and handoffs

Technology can reduce risk, but it should support—not replace—human verification. Small businesses should document a short payment-verification procedure in a location employees can reach during a busy workday. Include named roles, backup contacts, approved payment systems, and the escalation path for after-hours requests.

Useful controls and handoffs include:

• Mail security: Enable available filtering, anti-spoofing protections, attachment scanning, and user reporting. Configure alerts for suspicious forwarding rules or unexpected sign-in activity where the platform supports them.
• Identity controls: Require multifactor authentication for email, finance, payroll, and administrative accounts. Review mailbox delegates, recovery methods, and active sessions when compromise is suspected.
• Vendor records: Restrict who can create or edit supplier payment details. Require an independent callback and a second approval before a change becomes active.
• Payment platforms: Use beneficiary allowlists, transaction limits, dual authorization, and alerts when those features are available. Confirm that alerts go to more than one responsible person.
• Documented handoffs: Finance should know how to reach IT or security, and IT should know who can freeze or review payments. Keep emergency contact information separate from the potentially compromised mailbox.

Train employees with realistic examples rather than a single list of suspicious words. Include requests from executives, vendors, customers, and payroll contacts, because the correct response is the same: pause, independently verify, and obtain approval.

Quality checks

Managers can test the process with a short review rather than waiting for a real incident. Ask whether an employee can answer these questions without searching through an email thread:

• Where is the approved vendor contact information stored?
• Who may change payment or payroll details?
• What requires a second approval?
• How can a payment be paused or recalled?
• Where should suspicious messages and suspected credential theft be reported?

Check that the callback number is independently maintained, that approval records are retained, and that former employees or unnecessary delegates no longer have access to finance and email systems. Review whether staff can distinguish a normal invoice correction from a bank-account substitution. If the procedure depends on one person’s memory or one mailbox, it needs a stronger handoff.

Do not treat familiar branding, a valid signature, a known vendor name, or an email thread as standalone evidence. The quality check is whether the payment details were confirmed through a separate trusted route and approved under the organization’s normal controls.

When to revisit

Review this workflow whenever the business changes its bank, payroll provider, accounting platform, email system, approval matrix, or vendor-management process. Revisit it after a suspicious message, a near miss, a confirmed account compromise, or a payment sent to incorrect details. Platform features and menu names also change, so confirm that mail-reporting, sign-in review, payment alerts, and dual-approval instructions still match the tools in use.

At least quarterly, ask finance, IT, and business owners to verify their contact lists and escalation paths. Remove outdated callback numbers, test a backup approver, and confirm that new employees understand the rule for changed payment instructions. Update the examples when impersonation patterns change—for example, when attackers begin using a new collaboration platform or a different payment request.

The practical rule is simple: no urgent request should be able to change where money goes without an independent confirmation and an appropriate second approval. Save this workflow where employees can find it, and use it whenever an invoice, payroll change, vendor request, or executive instruction feels even slightly out of sequence.