Key takeaway
An accepted invoice and an authentic payment instruction are separate pieces of evidence. Verify changes through an independently trusted contact before anyone redirects a payment.
Protect the destination as well as the amount
A company may complete data-license delivery and still have an unresolved payment route. A message can ask the seller to amend its invoice bank details, register in a replacement portal or tell the buyer to use a temporary settlement account. The immediate question is who authorized that instruction and how the company knows it is genuine.
The FBI explains that business email compromise can involve spoofed addresses or access to legitimate billing conversations. A familiar thread and accurate invoice details therefore cannot, by themselves, authenticate a changed payment destination. The current FBI page recommends verifying changed account numbers or payment procedures and finding a company phone number independently of the suspicious message.
For a seller, apply that control to the instructions it issues and to changes purportedly required by the payer. Agree a verification route with the buyer’s authorized finance contact before the payment event. This is a proposed operating method based on US FBI guidance checked on 12 October 2026, not a conclusion about legal discharge of a debt or bank liability.
A changed instruction with an unresolved author
Hypothetical example: fictional seller S and buyer B have an accepted USD 40,000 invoice, I-14, for package P-14. No payment has arrived. The seller’s original approved bank profile is held in its controlled finance system. An email appearing in the existing conversation asks the seller to replace that profile with a temporary collection account and cites the correct package and invoice.
In this invented case, the seller’s controller calls B’s finance contact using the separately established number in the verified onboarding record. That contact says no replacement account was requested. The controller holds the proposed change, alerts the responsible security owner and keeps the receivable status unpaid.
| Verification point | Completed illustrative evidence | Decision |
|---|---|---|
| Underlying obligation | I-14 and accepted P-14 identified; receipt absent | Track USD 40,000 as uncollected under the scenario. |
| Change request | Email proposes a temporary collection account | Hold the bank-profile amendment; email is a request. |
| Independent contact route | Verified onboarding contact used; new email number ignored | Record the route’s provenance, not merely that a call occurred. |
| Authority check | B’s established finance contact denies the requested change | Do not instruct payment to the proposed account. |
| Internal approval | Controller retains original profile; security review assigned | No change approved; preserve relevant incident evidence internally. |
| Closeout status | No funds received and no authenticated replacement instruction | Keep payment and incident questions separately open. |
Keep a verification log without circulating bank credentials
The log should identify the invoice, paying and receiving legal entities, original approved instruction version, requested change, trusted contact route, verification time, person performing the check, response and authorized decision. Store the underlying bank documents in the controlled finance system. A reference to that evidence can be enough for the general issue log; avoid duplicating account numbers throughout project notes.
Separate verifying a person from verifying that person’s authority for this operation. A real commercial contact might have no role in changing the buyer’s supplier profile. Ask the established finance owner which process approves the update and what confirmation demonstrates completion. If the answer is missing, leave the change pending rather than selecting the most convenient email address.
The FBI’s dated April 2020 guidance specifically recommends using the contact on file instead of the number supplied in the change email. Its historical pandemic forecasts are not used here. In the proposed workflow, an independent second internal reviewer checks the recorded evidence before the authorized finance owner issues changed instructions; that second review is an editorial control recommendation, not an FBI-mandated rule.
Check the result at the actual payment step
In the hypothetical case, retaining the original bank profile does not show that B’s payable system still contains it. S asks its established authorized contact to confirm the relevant supplier-profile version through the agreed secure process. It does not accept a fresh screenshot sent by the disputed email as the missing confirmation. The team records what the trusted route actually verified and what remains unknown.
If a legitimate change is later established, issue one approved replacement version and state which earlier instruction it supersedes. Have the parties follow their own finance controls, then reconcile actual receipt against the invoice, currency, payer and any agreed deductions. A transfer reference may support investigation; verify the credited funds using the seller’s bank records before closing the receivable.
A verification delay does not automatically amend a contractual due date. Ask the responsible commercial and legal owners to resolve the actual agreement if timing is disputed. The payment-trigger guide handles when an amount becomes due, and payment-security evidence distinguishes a deposit from an unpaid guarantee. Neither substitutes for authenticating the destination.
Escalate a suspected diversion without promising recovery
If a fraudulent transfer may have occurred, the current FBI guidance says to contact the financial institution immediately and report business email compromise to IC3. Follow the company’s incident process and preserve the relevant request and transfer evidence. The guidance does not guarantee recall or recovery; do not model recovery as money already received.
A suspected payment diversion can also expose a compromised mailbox or other confidential information. Give the security owner the facts needed to investigate, rather than continuing a dispute with the suspicious correspondent or sending more documents to prove the deal is genuine. The approved incident channel and finance channel may need different owners.
Use Due diligence to record the payer and verified finance process. Do not put bank credentials, login information or raw business records into VOID’s inquiry or introduction brief. VOID has no upfront seller referral fee and may receive separately disclosed conditional program compensation. A receiving program’s payment instructions, seller license proceeds and VOID’s referral compensation remain distinct; a named introduction grants no sample or licensing permission.