A vendor changes payment instructions: pause and verify the change

A familiar vendor sends a message with new payment details. The name looks right, the invoice seems recognizable and the change sounds urgent. That combination can make the request feel routine even when the business has not independently established who sent it or whether the new instructions are authorized.

This guide is an operational verification exercise. It does not determine whether a message is fraudulent, allocate responsibility for a loss or prescribe the response to a completed payment. If a concern arises, promptly involve the appropriate financial institution, security personnel and legal advisers through verified channels.

Treat changed instructions as a separate event

Keep the requested change distinct from the underlying invoice. The business may know an invoice exists without knowing that a new payment destination is genuine. Preserve the message and identify exactly what changed.

Record the time received, the apparent sender and the requested action. Do not conclude that urgency proves either authenticity or fraud. It is a reason to use the established verification process rather than improvise one under pressure.

Use a previously verified channel

Ask the business's responsible staff how vendor changes are normally verified and approved. Use established contact information rather than relying only on the new message's links or numbers. The FTC's small-business scam guide provides official educational context about deceptive business communications. [1]

The guide does not authenticate this request. A successful call also needs an appropriate factual basis for knowing which person answered and what that person is authorized to confirm. Record the verification according to the business's reviewed process.

Identify who can approve the change

Separate the person entering payment details from the person authorizing them where the adopted process requires it. Staff should know when a changed account, new payee or urgent exception needs escalation. A familiar purchasing relationship should not erase those limits.

Do not make a policy exception appear routine after the fact. If normal verification could not be completed, preserve that fact and ask the responsible decision-maker how to proceed. This article cannot decide which exception is appropriate.

Keep supporting information limited

A verification conversation should not require casually forwarding passwords, banking credentials or a full set of customer records. Ask the appropriate financial and security professionals what information is necessary and how to handle it.

Avoid placing the suspicious message in public chat for analysis if it contains genuine account or business information. Authorized reviewers can use the established protected channel. Synthetic examples are more suitable for training and process walkthroughs.

Address uncertainty promptly

If the request cannot be verified, identify who is responsible for the next step. Do not mark it completed merely because someone attempted a call. At the same time, do not use a general fraud concern to decide a contractual payment obligation without appropriate advice.

If funds have already moved, promptly contact the financial institution and appropriate professionals through known channels. This guide cannot guarantee recovery, determine a reporting deadline or replace incident-specific instructions.

Learn from the event

After the issue is appropriately addressed, examine which part of the workflow created uncertainty. Was the vendor directory outdated? Did one person hold all approval authority? Was the change entered before verification? Use the findings to improve the reviewed process rather than simply telling staff to be more careful.

The useful habit is to recognize a payment change as a new decision requiring verification. Familiar names and urgent wording can influence attention; a reliable business process should determine the next action.

Separate the invoice from the destination change

A known invoice can be paired with an unverified payment instruction. Keep those two facts separate. Record which invoice or transaction the message references, what instruction changed, when the request arrived, and the apparent sender. Preserve the actual message through the appropriate process. Do not treat a matching invoice number as authentication of a bank destination, and do not treat an unexpected destination as proof that the underlying invoice is invalid. Each question needs its own evidence and responsible reviewer.

Identify whether the requested change concerns a new account, a different payee, a different payment method, or another condition. A vague note saying vendor updated can hide the significance of the request. The person entering the change should understand exactly what is proposed and which approval path applies. This article does not authorize a payment, determine fraud, or resolve contractual obligations. It helps the business recognize the change as a separate event that should not disappear into ordinary invoice processing.

Keep urgency factual. A message can demand immediate action, but that demand does not establish authenticity or the appropriate exception. Record the claimed reason and the actual business circumstances. An important supplier relationship may create pressure to respond quickly; it should not erase the need for the adopted verification process. Staff need a way to escalate uncertainty without being blamed for slowing a payment whose destination has not been independently established.

Maintain a verified contact directory before the request arrives

Identify the business contact channels previously established through the organization's approved process. A directory should record the source and review owner without exposing unnecessary personal information. When a change request arrives, use that existing path rather than a new number or link supplied only in the request. The FTC's small-business scam guide supports general awareness of deceptive business communications. [1] It does not authenticate the message or prescribe a complete control system for every business.

A call still requires a basis for knowing who answered and what they are authorized to confirm. Ask the responsible financial and security professionals how that identity and authority will be established. A familiar voice, forwarded email, or caller identification display may not answer every question. Record the actual verification through the adopted process. The goal is independent evidence, not merely another interaction that repeats the same unverified information.

Review the directory when staff or vendor contacts change. An outdated number or a departed contact can make a sound-looking process unreliable. If the usual contact cannot be reached, escalate the unresolved request rather than quietly using the new message's contact details as a substitute. This guide does not decide which exception is appropriate. The authorized decision-maker needs to know that normal verification was not completed and which facts remain unknown.

Keep verification, approval, and entry distinct

Describe the roles in the business's reviewed payment-change process. One person may receive the request, another verify it, another approve it, and another enter the change. The appropriate structure depends on the organization and professional assessment. Do not invent a universal rule from this article. The practical record should show which tasks were actually performed and prevent a completed data-entry step from being described as a completed authorization.

Bind the review to the specific change. A general note that the vendor is legitimate does not prove that a particular destination is authorized. An approval for one invoice may not cover a different account or later payment. Record the relevant transaction and protected destination reference through the approved system. Keep full account details and credentials out of ordinary project notes. The business should be able to trace the approval without creating a second uncontrolled store of sensitive banking information.

If the request changes again, return it to the process rather than editing the approved record silently. A second account, new payee, or altered payment method can require new verification. Preserve the sequence and actual state. Do not turn an urgent exception into a routine-looking history after the payment has been entered. An accurate record helps appropriate advisers assess the facts if a question later arises.

Use training that tests decisions without moving money

Prepare synthetic examples containing a recognizable invoice reference, changed payment details, and a plausible urgent explanation. Ask staff to identify the next step under the business's process. The exercise should not use genuine account information, send a real supplier message, or initiate a payment. Training can test whether people locate the verified contact, understand their role, and know how to escalate when the usual verification path is unavailable.

Include variations that expose assumptions. One message might come from an unfamiliar address, while another appears in an existing thread. One might change only a bank destination; another might change the payee name. Staff should not rely exclusively on spotting an obvious spelling error. The exercise should focus on the adopted process and evidence, not claim that a person can reliably diagnose every fraudulent message by appearance.

Record the gaps discovered. Perhaps the contact directory is inaccessible to the backup employee, the approver is unavailable, or the interface allows a destination change without retaining review evidence. Assign the gap to the appropriate owner and review the correction. Telling staff to be more careful does not repair an undefined workflow. A useful exercise produces a specific improvement and a way to verify it without exposing the business to a real payment event.

A fictional request inside a familiar thread

Imagine a fictional business receiving new payment instructions in what appears to be an ongoing supplier email conversation. The message references a genuine invoice and asks for a quick update because of a claimed banking issue. The employee recognizes the transaction but follows the change process. The employee contacts the supplier through a previously verified channel and records the result. Familiar context has not been allowed to substitute for independent verification of the new destination.

Suppose the verified contact cannot confirm the change. The employee records that uncertainty and escalates rather than labeling the request fraudulent or proceeding to avoid inconvenience. The business's authorized decision-maker and advisers can assess the next action. The example does not establish how a real payment obligation should be handled or prove that the message is malicious. It illustrates the distinction between knowing a transaction exists and knowing where money should be sent.

If later evidence confirms a legitimate change, preserve that evidence and follow the approved authorization and entry process. If the concern remains unresolved, retain the actual state. A failed verification attempt is not completion. The business needs both a route to resolve a genuine supplier update and a route to stop an unverified destination from becoming the default merely because the invoice is familiar.

Treat completed-payment concerns as a different situation

If funds have already moved and a concern arises, promptly contact the financial institution and appropriate security and legal professionals through known channels. Tell them the actual payment facts and preserve relevant records. This article does not supply an emergency-response sequence, decide a reporting duty, or guarantee recovery. The institution and advisers need the real situation, including timing and actions already taken, to provide instructions within their roles.

Do not continue interacting through the suspicious message to investigate on your own. Do not publish the message or account details in public chat. Use the organization's protected review process and ask what information should be preserved and shared. If credentials or system access may be involved, tell the appropriate technical reviewer. A payment destination issue can coexist with an access concern, but this guide cannot determine the scope of an incident from the message alone.

Keep the contractual question separate. A suspected payment problem does not by itself settle whether an amount is owed, whether a deadline applies, or which party bears a loss. Counsel should assess those matters based on the agreement, facts, and current applicable law. The operational process should prevent additional unverified action while providing the evidence needed for that review, rather than producing a confident legal conclusion in a payment log.

Improve the specific control that failed or remained uncertain

After the event is appropriately addressed, review the actual path. Was the verified contact outdated? Did one person's absence remove the only approval route? Was a change entered before the evidence was recorded? Did the interface obscure the difference between payee and destination? Identify the concrete gap and ask the responsible financial, security, and legal reviewers about the improvement. Avoid assuming that one event proves the entire supplier relationship unsafe or that one correction solves every future risk.

Maintain an accountable change record with the request, independent verification, approval, implementation, unresolved questions, and later corrections. Use protected references where appropriate instead of unnecessary account data. The useful habit is not suspicion of every vendor communication. It is recognition that changed instructions are a new decision requiring the adopted verification and approval path. That habit supports reliable administration while leaving authenticity, payment obligations, and incident consequences to the proper evidence and professional review.