A vendor sends a convincing email saying their bank account has changed. The invoice number matches, the signature looks familiar, and the message appears in a genuine ongoing thread. That is exactly when a business should slow down—not because every change is fraudulent, but because payment instructions deserve independent verification.
A contractor regularly emails a property company’s accounting inbox. A new reply requests payment to a different routing number shortly before the usual payment date. The person processing invoices is tempted to accept it because the sender name and old thread look legitimate.
Try InboxCabin free for 30 days. No credit card required.
Start Free TrialWhy this happens—and what actually needs fixing
Business email compromise frequently relies on authority, urgency and familiar context. A compromised mailbox or lookalike domain may make a malicious instruction feel routine. An email reply alone is weak proof that payment details truly changed.
For a small team, an improvement is only useful if the people doing the work can explain it plainly. Keep the operating procedure visible and make sure the expected action is unambiguous.
Convenience and security must be evaluated together
Whenever a workflow handles credentials, money, confidential documents or recipient identity, assume a busy person will occasionally make a mistake. Put the safeguard at the exact point where the mistake happens: before Send, before changing payment instructions, before revoking a permission or before an account recovery becomes urgent.
A checklist is useful because it does not depend on perfect judgment during a stressful moment. But it is not a substitute for documented organizational controls. When legal duties, regulated data or corporate sign-in policies apply, ask the responsible security or compliance owner before changing the process.
What this looks like in practice
Treat every payment-destination change as a new transaction risk, even if the invoice itself is routine. Email evidence is useful for documenting the request but weak for confirming who made it. Build an approved vendor record with a known phone number and an escalation contact established before the next invoice arrives. When a payment change request arrives, one person verifies through the known route and another authorizes the update in the financial system. Document the outcome and retain the original message for investigation if appropriate. Most importantly, do not test this process by sending a small payment to an unverified account; use a fictional tabletop scenario to rehearse the controls safely.
Step-by-step: a process you can actually use
1. Separate the invoice from the payment change
Review the invoice as usual; put the changed banking instruction on hold until verified.
2. Call a known number
Use the telephone number already on file or a previously verified vendor contact—not the number supplied in the change email.
3. Use two-person approval
Have someone other than the email recipient confirm and record the banking change.
4. Check the full sender address
Look for lookalike domains and reply-to changes, but remember even real accounts can be compromised.
5. Keep an audit note
Record the name, number, verification time and person approving the change.
6. Release payment only after confirmation
Retain supporting documents and use the normal payment approval procedure.
A worked example from a normal business day
The accounting clerk calls the vendor’s existing office number and asks for a confirmation through the vendor’s documented process. The vendor says no banking update was requested. The fraudulent message is escalated, and the company avoids wiring funds to an unverified destination. The example is illustrative, not a claim about an InboxCabin customer.
Three mistakes to avoid
- Calling the phone number supplied in the suspicious email.
- Treating a reply inside an old thread as proof of authenticity.
- Making emergency exceptions to approval controls because a due date is close.
Run a safe tabletop test—not a real transfer
Use a fictional payment-change email and a dummy supplier. Ask the billing reviewer to identify the independent contact route, a second approver, and the stop condition. No actual payment or real banking data is needed.
Then document the approved workflow in the accounting procedure so that a future rushed request is handled consistently.
How to tell whether the change is working
Track bank-change requests, how many receive independent verification and the number of exceptions granted. The goal is consistent verification, not maximum processing speed.
Security and policy boundaries
Follow your bank’s fraud reporting procedures if payment was already sent. InboxCabin does not inspect payment instructions or certify sender authenticity.
Where a dedicated email workspace fits
InboxCabin can help keep billing and vendor mailboxes separate for easier review, but the financial verification must happen outside the email thread.
Frequently asked questions
Is a familiar thread proof that a payment change is legitimate?
No. Real mailboxes and existing threads can be compromised.
Can an email application guarantee a vendor bank change is safe?
No. Independent out-of-band verification and approval controls are essential.
Further reading
For current provider behavior and supported controls, see FBI guidance on business email compromise. Product interfaces change, so confirm instructions in the version your organization uses.
New to the product? Read Meet InboxCabin to see the dedicated multi-inbox workspace and how it is different from a unified mail client.
Related guides
- Email Attachments vs Secure Cloud Links: A Small-Team Guide
- Sent an Email to the Wrong Person? A Calm Incident-Response Plan
Explore InboxCabin for a dedicated Windows workspace that keeps Gmail and Microsoft accounts separate and easy to reach.
The takeaway
Review the invoice as usual; put the changed banking instruction on hold until verified.
Try InboxCabin free for 30 days. No credit card required.
Examples in this article are illustrative, not customer case studies or promises of results.