Chris Mospaw

Most business owners have vendors they work with regularly. You recognize the company, the names, the invoices, and the email addresses.

Then one day an email arrives:

“We’ve changed our banking information. Please send future payments to this new account.”

That may be completely legitimate.

It is also exactly the kind of request you should verify before doing anything.

A Familiar Email Is Not Enough

Fraudulent payment requests can be surprisingly convincing.

Sometimes a criminal creates an email address that looks almost identical to the real one. In other cases, a legitimate email account may have been compromised, which means the message can actually come from the address you recognize.

That is why looking at the sender’s name — or even the email address — should not be your only verification.

Use a Second Channel

The safest habit is simple:

If payment information changes, independently verify the change before sending money.

Call the vendor using a phone number you already have in your records or another contact method you already know is legitimate.

Do not rely on a new phone number supplied in the same email that contains the payment change.

And don’t just reply to the message with, “Is this really you?” If someone has control of that email account, you could be asking the same person who sent the fraudulent request.

Make It a Business Procedure

This works best when it is a normal procedure rather than something employees have to decide case by case.

A small business can establish a rule such as:

Any change to payment instructions must be confirmed independently before payment is sent.

That rule should apply even when:

• The sender is familiar
• The request looks routine
• The amount is expected
• The message says it is urgent

You may also want a readily available list of trusted vendor contacts so employees do not have to search an email for a phone number when they need to verify something.

If Money Has Already Been Sent

If you discover that a payment may have gone to a fraudulent account, contact your financial institution immediately. The sooner the problem is reported, the better the opportunity may be to stop or recover the transfer.

Security Is Also About Good Habits

Cybersecurity often sounds like firewalls, antivirus software, passwords, and complicated technical systems.

Those things matter, but many risks happen at the point where a person has to make a decision.

A clear, simple procedure can sometimes prevent a very expensive mistake.