On this page
Treat the change as a new verification event
Business email compromise can involve a genuine business email account being misused. The FBI’s Internet Crime Complaint Center (IC3) recommends secondary-channel verification for account-information changes and rapid contact with the financial institution when fraud is recognised.
Apply that warning to your U.S. expansion payments: equipment deposits, service invoices and transfers between related teams all need an assigned process. An existing commercial relationship does not verify a newly supplied account.
Give the checker a trusted route
This is an ELN control checklist, not a complete bank or cybersecurity procedure. Use the business’s authorised secure systems for the underlying bank data.
| Step | Evidence to retain |
|---|---|
| Receive the request | Original request and who received it |
| Find a trusted contact route | Existing independently verified contact details, not only details in the change request |
| Verify the change | Who checked, when, with whom and the result |
| Approve the master-data change | Authorised decision and restricted change record |
| Approve payment | Correct payee details, amount and normal payment authority |
Do not approve the new account because the invoice is real
Fictional example: a genuine US$24,000 invoice is due. An email in the existing conversation supplies a replacement account and asks for urgency. Your team can verify the invoice while the new payment destination remains unverified.
Use the trusted contact route and the actual bank procedure before changing the payee. A callback to a new number supplied in the same message is not the independent route described here. This example involves no real account details.
Escalate quickly if a transfer may have been diverted
Follow the bank’s fraud-response process immediately if a payment may have gone to the wrong destination. IC3’s guidance includes contacting the originating financial institution to request recall or reversal; recovery is not guaranteed.
For the owner, the ongoing task is to assign verification, supplier-data changes and payment authority so an overseas time-zone gap does not encourage an unrecorded exception. Do not place bank details or identity documents in this site’s educational worksheets.
Scope
- Risk-reduction process only, not a guarantee against fraud, a bank-recovery promise or a substitute for the actual bank and incident-response procedures.
Next step
Use Management dependence to assign supplier-change verification, backup and payment-release authority. Store the actual banking evidence in your restricted business systems.
Sources & review notes
FBI Internet Crime Complaint Center
Passage, dates and research notes
official-guidance · Stay Protected; What To Do In Case Of A BEC Incident
Complete page read. Independent verification and rapid bank contact reduce risk without guaranteeing prevention or recovery.
Bookmark this guide or mark it as read.
Progress privacy
Saving is off by default. Without it, progress lasts only on this page. If you turn it on, this browser profile stores public content IDs and the progress you record. Anyone sharing the profile could see them. No plan inputs or contact details are included. Reset or export in learning settings.
This is a reading aid, not evidence of disclosure delivery, expertise or legal approval.