A fake request to change a vendor's payment details is a form of business email compromise, or BEC. The FBI's Internet Crime Complaint Center (IC3) received 24,768 BEC complaints in 2025, up from 21,442 in 2024, with reported losses of just over $3 billion. Among the cyber-enabled fraud types in the IC3's 2025 report, only investment fraud cost victims more.

The IC3's definition is worth reading closely: the criminals compromise email accounts and other forms of communication, including phone numbers and virtual meeting applications. That is why the check has to run through a contact you had before the request arrived.

How a fake request reaches you

The request usually looks routine. If a criminal has broken into the vendor's mailbox, the message can arrive inside a genuine invoice thread with the right names, amounts and signature. Otherwise it may come from a lookalike address that differs from the real one by a character or two. Microsoft notes that a lookalike domain with valid DNS records can pass the standard email authentication checks (SPF, DKIM and DMARC), so a message that passes authentication can still be fake.

The message often brings its own proof, such as a letter on bank letterhead, a voided check or a new phone number in the signature. All of it arrived with the request, so none of it can confirm the request. The goal is usually a bank transfer: in the IC3 report's chart of the transaction types BEC complainants reported, wire transfer or ACH accounts for 86 percent.

Replying to ask whether the change is real does not help, because the reply may reach the same account that sent the request. Microsoft lists inbox rules that forward mail to unknown addresses, or move it to the Notes, Junk Email or RSS Subscriptions folders, among the common signs of a compromised mailbox, and rules like these can hide your question from the real owner. The IC3 report also warns that voice cloning can be used to request wire payments, so a call that comes to you is not verification either.

Know what counts as a payment change

Run the check for any of these, whatever the amount and whoever appears to be asking:

  • A new bank account or routing number for a vendor you already pay
  • A switch from check to ACH or wire, or a new remit-to address
  • An employee asking to move their direct deposit to a different account
  • A request from your owner or manager to pay an account you have not paid before
  • A new phone number, email address or billing contact for a vendor
  • Any of these changes entered through a supplier portal or self-service form

Contact details are on the list because whoever controls the phone number in your file controls your next verification call. A bank change also outlasts the invoice that came with it, since every later payment goes to the new account until someone notices.

Verify with a call you place yourself

When a request arrives, work through the same steps every time:

  • Stop before you edit the vendor record or release a payment.
  • Find the phone number in your own vendor file, saved before this request arrived, and ignore any number, link or attachment in the request.
  • Call that number and ask for the person authorized to change payment details.
  • Ask them to describe the change and read the new account details to you, rather than reading them out yourself.
  • If they confirm it, have a second authorized person review the change before the new details are used.
  • If they say they sent nothing, keep the old details and tell them their email may be compromised.

Federal guidance backs this up. The FTC advises small businesses to call using a number you know to be correct, not the one in the email or text, and to require employees to call and confirm wire transfer requests they receive through email. The FBI recommends secondary channels for verifying requests to change account information.

If the number in your file no longer works, take the vendor's main number from the contract or setup paperwork, or from its website with the address typed in yourself, and ask for the person who handles billing. Note in the log where that number came from.

Decide the harder cases in advance

Write these rules into the procedure so nobody has to make them up under pressure:

  • If you cannot reach the contact on file, keep the old details and leave the change pending, even if a payment is due; a late payment is easier to fix than a misdirected one.
  • If the person hesitates, offers a different number to call, or asks you to read the details out, treat the change as unconfirmed.
  • If their details differ from the request by even one digit, treat the request as fake and warn the vendor.
  • If the request came from inside your organization, confirm it in person or on the number in your staff records.

Urgency and secrecy are part of the script

If someone asks you to keep the change quiet, says they cannot take a call, or insists the payment must go through today, follow your normal approval process anyway. The IC3's 2025 report notes that AI chat generators can quickly produce official-sounding emails mimicking a company's CEO, and that businesses reported more than $30 million in 2025 losses to BEC scams involving AI. A polished message from a familiar name proves nothing, and a real vendor or manager can wait for a callback.

Small details help too. The FBI's BEC guidance suggests verifying the sender's email address, especially on a phone or other handheld device, and watching for links that misspell the real domain name.

Common mistakes and how to spot them

These shortcuts defeat the check, and each leaves a trace you can look for:

  • Calling the number in the email signature or on the attached letter; check where each number in your log came from.
  • Updating the contact details first and then verifying with the new ones; look for contact and bank changes made on the same day.
  • One person receiving, verifying and approving a change; the log should show two names.
  • Trusting a familiar display name; check the address behind it, since Microsoft's own impersonation example pairs a real employee's name with a different address.

Once a month, compare every bank-detail change in your accounting system with the callback log. Any change without a matching entry is a gap to close.

Keep a record of every check

Write the check down each time, including when the request turns out to be real:

  • Who asked for the change and how the request arrived
  • Which contact from your records you reached, and the number you called
  • The date and time you spoke, and what they confirmed or denied
  • Who approved the change and when the new details take effect

Keep the log where your team can find it. Keep the banking details themselves in your accounting or payment system rather than forwarding them around by email.

Turn on the warnings your email already offers

In Microsoft 365, the "Show first contact safety tip" setting in anti-phishing policies is available for all cloud mailboxes. It warns people the first time they get a message from a sender, or when they don't often get messages from that sender, which is how a lookalike vendor address first appears. Microsoft recommends turning it on. The policies are in the Microsoft Defender portal under Email & Collaboration, then Policies & rules, Threat policies and Anti-phishing.

Microsoft Defender for Office 365 adds user and domain impersonation protection. Microsoft's service description says its Plan 1, which includes both, comes with Microsoft 365 Business Premium and, since July 1, 2026, with Office 365 E3 and Microsoft 365 E3.

In those policies, "Enable domains to protect" accepts up to 50 custom domains per policy, such as your main vendors' domains, and "Enable users to protect" accepts up to 350 people, such as your owner and finance staff. Nothing is listed by default and the default action is "Don't apply any action," so add them, choose an action such as quarantine, and turn on the impersonation safety tips.

In Google Workspace, the Admin console's Gmail safety settings (Apps, Google Workspace, Gmail, Safety) include "Protect against spoofing of employee names" under Spoofing and authentication. It flags messages that use the name of someone in your directory but do not come from your domain, which helps when a payment request appears to come from your own owner. Google describes the nearby "Protect against domain spoofing based on similar domain names" setting as protection against domains that look like your own company's domains or aliases, so do not count on it to catch a fake version of a vendor's domain. Each setting can keep the message in the inbox with a warning, which is the default, or move it to spam or quarantine.

These warnings look for unfamiliar or lookalike senders. A request sent from the vendor's real mailbox after a break-in will usually carry none of them, so the callback remains the control that matters.

Check your own mailboxes too

Microsoft notes that attackers often use a compromised mailbox to send messages to recipients inside and outside the organization, so one of your own payment mailboxes could send fake instructions to your customers or hide a vendor's warning. Besides suspicious inbox rules, Microsoft's warning signs include recently added external forwarding, suspicious messages in Sent Items or Deleted Items, and frequent password changes or unexplained lockouts.

Ask whoever manages your email to review the mailboxes that handle payments, including hidden inbox rules. In Microsoft 365, the "Automatic forwarding rules" setting in the outbound spam filter policy defaults to "Automatic - System-controlled," which behaves differently from one organization to another, so Microsoft advises choosing "On - Forwarding is enabled" or "Off - Forwarding is disabled" instead. With Off, automatic forwarding to outside addresses bounces with error 5.7.520, and the Auto forwarded messages report shows who is forwarding mail outside.

Google's admin help says Automatic forwarding, under Gmail's End User Access settings, is on by default and can be limited to internal addresses. On either service, require multifactor authentication for every mailbox; Microsoft calls it an effective safeguard against account compromise.

If the money has already gone

Time matters most. The FBI's guidance is to contact your financial institution immediately and request a recall of the funds, along with any indemnification documents it needs, and to file a complaint at ic3.gov as soon as possible with the full transaction details, whatever the amount lost. In 2025 the IC3 Recovery Asset Team started its Financial Fraud Kill Chain process for 3,900 incidents across fraud types and helped freeze about $679 million of roughly $1.16 billion in attempted theft. Keep the original emails, and tell the vendor through the number in your records.

If your business sends ACH payments

If you pay vendors or staff by ACH through your bank, ask the bank whether that makes you a non-consumer Originator under Nacha's rules. If it does, Nacha's fraud monitoring rules apply to you. Their second phase, which reached the non-consumer Originators the first phase did not cover, took practical effect on Monday, June 22, 2026, the next banking day after the June 19 federal holiday. The rules call for risk-based processes and procedures reasonably intended to identify ACH entries suspected of being unauthorized or authorized under False Pretenses, reviewed at least annually. Nacha says that term covers business email compromise, vendor impersonation and payroll impersonation.

Nacha's FAQ says the rules do not prescribe specific procedures or require every entry to be screened individually, but a risk-based approach should not be used to conclude that no monitoring is needed at all. For Originators, it suggests procedures could include change controls over payment information and instructions for vendor and payroll payments. A written callback procedure and its log are a sensible place to start, and your bank can tell you what it expects.

A worked example

Imagine a twelve-person property management office. On Thursday the office manager receives an email from the landscaping contractor's real billing address, in the thread where its invoices always arrive. Friday's invoice is attached, with a letter saying the contractor has changed banks and a signature showing a new phone number. The office gets mail from that address every month, so no first contact tip appears.

She does not reply and does not call the new number. She opens the vendor file, calls the number saved when the contractor was set up, and asks for the owner, who is listed as the person who can change payment details. She asks whether anything about how they get paid has changed, without describing the letter.

The owner says nothing has changed. She tells him his email may be compromised, logs the call and keeps the old account in place. She also reports the message to the person who manages the office's email, who checks the office's payment mailboxes for unfamiliar rules and forwarding, since an attacker could have read the thread from either side. Friday's payment goes to the account on file.

Had the owner confirmed the change, he would have read the new account details to her, she would have checked them against the letter, and the office's second approver would have reviewed the log before Friday's payment went to the new account. Either way, the log shows who asked, which number she called, what was said and who approved the outcome.

Check that the procedure works

Test the procedure and the settings before a real request does:

  • Hand whoever edits vendor records a mock change request on paper and watch whether they find the number on file, call it and log the call.
  • From a personal address that has never written to the office, email a work mailbox at least a week old and look for the first contact tip, which Microsoft skips on mailboxes created less than seven days earlier.
  • After any real change, confirm the first payment to the new account arrived by calling the contact on file.

What to do this week

Try the procedure before you need it:

  • Pick a familiar vendor, find its approved contact record, and ask your team who would make the verification call.
  • If the contact details or the decision owner are unclear, fix that gap while no payment is waiting.
  • Check that your main vendors' phone numbers came from contracts or setup paperwork, not from recent emails.
  • Write the steps above into a short procedure and name who can approve a change.
  • Ask your bank how to request a recall, what indemnification documents it uses, and whom to call outside business hours.
  • Ask whoever manages your email to turn on the warnings above, set external forwarding deliberately, and require multifactor authentication.

A process that takes a few minutes to practice is easier to follow under pressure. The FBI also points out that banks have varying policies on recovering funds, so learn what yours will do before you need it.

Payroll changes and your own customers

Direct deposit changes get the same callback. Confirm with the employee in person or on the number in their personnel file, and ask staff to report a missing paycheck deposit right away; the FBI lists missing deposits among the irregularities to watch for.

Your own customers face the same risk. Tell them at setup or on your invoices that you will never change bank details by email alone, and that they should call the number in their records before paying a new account.

If a customer calls about a payment change you did not send, have your mailbox checked for compromise. Microsoft's response steps include disabling the account or resetting its password, revoking active sign-in sessions, and removing forwarding or inbox rules the attacker added. Do not email the new password, since the attacker may still be reading the mailbox. If someone is spoofing your business email, the FTC suggests reporting it to local law enforcement, the FBI's IC3 and the FTC, and telling customers as soon as possible in a notice without links.

Where ALCO can help

ALCO USA Inc is an IT services company headquartered in Caldwell, Idaho, with technicians serving businesses across Idaho. Its listed services include email security, Microsoft 365, Google Workspace, cybersecurity and compliance, and user training. The ALCO help desk is staffed 24 hours a day, including holidays, and calls are answered by a person. If a payment request looks wrong, or you want your mailboxes checked for unexpected forwarding rules, that is a reasonable call to make.

Sources