How a believable payment request can be manipulated
Business email compromise does not always look like an obvious spelling mistake. A fraudster may impersonate an executive or supplier, take over an inbox, or monitor a real conversation before sending a last-minute request. The Canadian Anti-Fraud Centre describes spear phishing and payment redirection as risks to businesses. A familiar display name is not enough to confirm who sent a message.
The request may arrive during a real invoice cycle, refer to a real project, and use a plausible signature. The key signal is often the change in payment instructions, urgency, secrecy or approval path. A well-designed workflow assumes that email accounts can be spoofed or compromised and verifies high-risk changes outside the email thread.
Verify changes through a known channel
Before changing supplier banking details, call a phone number already on file—not a number in the new email. Ask the supplier to confirm the change and document who approved it. For an executive request, use the company directory or an established second channel. Do not use a reply-to address or phone number supplied only in the questionable message.
Separate the person who changes vendor information from the person who releases payment where staffing allows. Use a second approver for large or unusual transfers. Write down thresholds and exceptions so employees do not have to invent a procedure under pressure. A short delay to verify details is less costly than sending funds to an account controlled by a fraudster.
Reduce the chance of account takeover
Use unique passwords and multifactor authentication for business email, domain, finance and social accounts. Limit access to shared mailboxes and review forwarding rules, delegate permissions and sign-in alerts. Keep devices and applications updated. These controls do not make an organization invulnerable, but they raise the effort required to misuse an account and make unexpected access easier to notice.
Train staff with examples of unusual requests: secrecy, gift-card purchases, changed account details, urgent document links and unexpected login prompts. Teach them to report a suspicious message without clicking links or forwarding it to colleagues as a warning. Preserve the original message and headers when an incident needs investigation.
Respond quickly if money or access is at risk
Contact your financial institution immediately if a payment may have gone to the wrong account. Ask the relevant email administrator to secure the account, revoke active sessions, inspect rules and confirm recovery methods. Change passwords from a trusted device, then review access to other connected services. Preserve invoices, emails, timestamps, transaction references and the person who received each report.
Report suspected business fraud to local police and the Canadian Anti-Fraud Centre, following current official instructions. Tell affected suppliers or customers using a verified channel. A response plan written before an incident should name the decision-maker, bank contact, IT support and record-keeping location. It should also include a clear rule: verify changes independently, even when a message looks routine.
Practical checklist
- Confirm new banking instructions using a previously verified phone number.
- Require a second approval for unusual or high-value payments.
- Enable multifactor authentication and inspect mailbox forwarding rules.
- Report suspicious payment activity to the bank quickly and preserve evidence.
In short
A callback to a known number, combined with independent approval, is a stronger control than relying on the appearance of an email.
This article is general educational information, not legal, privacy, cybersecurity or financial advice. Confirm requirements for your situation with a qualified professional.