A supplier can send genuine invoices for years before a payment-detail change arrives. Familiar branding, an expected amount and a convincing email thread can make the change feel routine. The useful control is to verify it through a route that does not depend on trusting that message.
This is a business-process exercise. It does not tell you that a particular supplier is fraudulent or authorise a payment.
Move verification outside the request
The National Crime Agency describes invoice fraud as criminals diverting payment through impersonation or intercepted correspondence. Its prevention guidance says to check changed details and verify with the genuine supplier using a previously used phone number before transferring money. [1]
A reply in the same thread does not establish an independent route. For your procedure, use a contact already established separately from the change request. If you cannot establish that route, keep the change unresolved rather than accepting a number supplied in the suspect message as the answer.
Separate three decisions
| Step | What it establishes | What it does not establish |
|---|---|---|
| Receive the change request | Someone has requested different payment details | That the request is genuine |
| Verify independently | The change has been checked through an established contact route | That the invoice has been approved for payment |
| Approve under the usual process | The authorised person has made the payment decision | That earlier verification can be skipped |
This separation is a READY/ process suggestion, not a requirement that every small business employ three people. A sole trader can preserve the distinction in a short note and a deliberate pause between checking a change and acting on it.
Try an uncomplicated desk exercise
Use a clearly labelled practice note, with no real bank details: “A regular supplier asks for payment to a new account today.” Ask the person who normally handles invoices to explain the next action.
Where will they find the established number? What will they do if the usual contact is unavailable? Who may approve a change to the supplier record? What evidence will show the check was completed?
Do not send a simulated scam to a real supplier or customer. This exercise can stay entirely within your own procedure. Its purpose is to expose an unclear step without making a payment or changing a genuine record.
Record the outcome, not an impression
“Looked genuine” is not a useful audit note. A more informative entry identifies the date, the independent contact route used, who carried out the check, the result and any unresolved question. Store genuine financial details securely in the business’s normal system.
If the check remains unresolved, make that status visible to whoever would otherwise pay. A note that another person can interpret is more useful than a private assumption in an inbox.
If money may already have gone
NCSC advises contacting the bank directly through its official website or phone number and informing the person responsible for IT as soon as possible. [2] Do that promptly rather than waiting for the suspect email account to reassure you. No outcome or recovery of funds is guaranteed here.
A reliable process gives a genuine supplier change a clear route through the business while keeping urgency from replacing verification.
Run the free Business Downtime Test →