Payment-Change Requests: A Verification Policy Your Firm Can Adopt in a Day

Business email compromise often doesn't look like hacking. It looks like an ordinary note from a vendor, a client, or a partner: "We've changed banks. Please use the new account details below for future payments." Someone updates a record, the next payment goes out, and nobody notices until the real vendor asks why they haven't been paid.

The good news is that the defense is mostly a policy, not a product. A short, written rule about how payment details are allowed to change, applied every time, closes the gap these schemes depend on. Here is one any small firm can adopt this week.

Why this is worth an afternoon

The FBI's Internet Crime Complaint Center received 24,768 business email compromise complaints in 2025, with about $3.05 billion in reported losses.¹ Those are reported figures only. In a survey of 465 treasury practitioners published in April 2026, the Association for Financial Professionals found that 74 percent of organizations were affected by business email compromise in 2025.²

Firms of 10 to 100 people are not too small to be on that list. They often have one or two people who handle payables, a long list of vendors, and a culture of getting things done quickly. That combination works in a fraudster's favor unless there is a rule everyone follows.

The policy, in five parts

Each part fits in a sentence or two. Together they fit on one page.

1. No payment detail changes by email alone

A request to change a bank account, routing number, payee address, or payment method is never acted on based on an email, a PDF attachment, a text, or a phone call the other party started. Every request triggers verification, no matter how routine it looks or who appears to be sending it. The FBI's guidance on business email compromise is direct on this point: use secondary channels to verify requests for changes in account information.³

2. The callback rule: use a number you already had

Verification means calling the requester at a phone number your firm already had on file before the request arrived, or one you look up independently, such as from a signed contract or the company's official website reached by typing the address yourself. Never use a number, link, or contact name provided in the request itself. Nacha, the organization that governs the ACH network, gives the same advice: look up the company's number on your own, and don't use the one a potential scammer provides.⁴

On the call, ask the person to confirm the change without reading the new details to them first. Let them tell you. Note the date, time, and who you spoke with.

3. Two people for every change

The person who receives a change request should not be the only person who approves it. Name, in writing, who can approve a change to payment details (for example, the office manager plus a partner or controller). The second person checks that the callback happened and was documented before the record is updated. Nacha recommends dual controls for approving certain transactions.⁴ The logic is simple: one person under time pressure is easier to fool than two.

4. Urgency is a reason to slow down

Write this into the policy in plain words: a request that is urgent, confidential, or "just this once" gets the same verification as any other, and anyone may pause a payment to verify it without needing permission. People follow a rule more readily when they know leadership will back them for following it, even if it delays a payment by a day.

5. Watch the first payment after a change

After any approved change, confirm with the vendor, through the verified contact, that the first payment to the new account arrived. If something went wrong, this is how you find out in hours instead of weeks.

What to tell vendors and clients

A policy works better when the people on the other side know about it. Nacha suggests setting up a two-step process with customers, vendors, and business partners so that any change to payment instructions is confirmed outside the channel it arrived through.⁴ A short note to your vendors is enough. Something like this:

To protect both of us, [Firm Name] does not change payment details based on email. If your banking information changes, please expect a call from us at the number we have on file before we update anything. If you ever receive a message that appears to come from us asking you to send payments somewhere new, please call us at [known number] before acting on it.

Send it once, add it to new-vendor paperwork, and include a line in client engagement letters if clients pay you by transfer. Your clients face the same scheme in reverse: an email that appears to come from your firm with "updated" payment instructions.

A hypothetical walk-through

Here is how the policy plays out in an illustrative case, not a real incident. An office manager receives an email from what appears to be the firm's cleaning service, with a new invoice and a note saying their bank changed. The sender address is one letter off from the real one, which she doesn't notice on her phone.

Without a policy, she updates the record and pays. With the policy, she doesn't need to spot the fake address at all. She calls the cleaning service at the number in the vendor file, learns they haven't changed banks, and forwards the email to whoever handles suspicious messages. The rule did the work, not her eyesight.

That is the main point of a verification policy. It doesn't depend on anyone recognizing a fake. It depends on a step that happens every time.

If a payment has already gone out

Put these steps at the bottom of the same page so they're easy to find under stress:

• Call your bank immediately and ask them to recall the payment.
• File a complaint at IC3.gov with the full transaction details.
• Contact the real vendor or client at a number you already had.

The FBI stresses that time is of the essence.¹ Its Recovery Asset Team reported freezing about $679 million of roughly $1.16 billion in attempted theft across 3,900 cases it initiated in 2025.¹ Recovery is never guaranteed, but it is far more likely when the bank hears about a transfer quickly.

Making it stick

Writing the policy takes an afternoon. The harder part is making sure it still holds on a busy Friday when the request looks perfectly normal. That comes from practice: staff seeing realistic payment-change messages in a setting where getting it wrong costs nothing, and from leadership treating a paused payment as a job well done. We cover why short, repeated practice beats a once-a-year session in Why Annual Security Training Doesn't Stick, and the signals worth checking in any message in Five Email Red Flags Worth Checking Before You Click or Pay.

For a broader self-check that covers payment verification along with account access and reporting, use the free Email Fraud Readiness Checklist.