An imagined small-business coordinator pauses to verify an invoice by phone. Original editorial painting, not a documented incident or a depiction of Foundation personnel.
When payment instructions change, a trusted callback can interrupt a convincing fraud and protect the relationship behind the invoice.
By Arbab Naseebullah Kasi, Chief Executive Officer - CEO, Feel Worldwide Foundation Inc.
The order arrived. The amount looks right. The supplier’s name is one you recognize, and the email sits inside a conversation that has been running for weeks. Only one thing has changed: where the money should go.
That small change deserves its own decision.
For a busy business owner, a nonprofit coordinator or someone paying a contractor, the danger is often wrapped in a legitimate obligation. There really is a bill to settle. Someone really is waiting to be paid. A criminal tries to place a different destination inside that existing relationship, relying on the surrounding truth to carry the false instruction through.
The practical response is to separate the invoice from the payment change. Verify the work and amount through ordinary records. Verify new banking instructions through an independently trusted contact route before releasing funds. A brief delay can be uncomfortable, especially when a delivery or deadline is involved. It is still better to resolve the uncertainty before money moves.
Why the message can look completely ordinary
Invoice fraud takes more than one form. In a May 2026 consumer alert, the US Federal Trade Commission warned that businesses receive bills for products or services they never ordered. Some arrive with overdue notices; others are phishing messages intended to obtain access to business data or networks. Checking that a purchase actually occurred is an essential first step. FTC guidance on fake business invoices.
Payment diversion is harder to spot when the underlying purchase is real. Business email compromise, usually shortened to BEC, can involve impersonation or intrusion into an actual business mailbox. The attacker may know the customer’s name, the order history and the expected payment date. A convincing message does not have to contain an obvious spelling mistake.
Australia’s Scamwatch explained in its 4 April 2024 invoice-scam alert that fraudulent messages can come from a compromised business address or a slightly altered address. They may appear within the existing email conversation. Replying to ask whether the changed details are correct can simply produce another answer from the scammer. This is Australian public guidance describing a mechanism that is also relevant elsewhere, not evidence that every suspicious invoice follows the same pattern. Scamwatch invoice-scam alert.
Read the full sender address and compare documents, but do not make a familiar logo, professional signature or clean-looking email the final test. The question that matters is whether the intended recipient has independently confirmed the new instruction.
A large reported loss does not predict your next invoice
The FBI Internet Crime Complaint Center’s 2025 Annual Report recorded 24,768 complaints classified as business email compromise and $3,046,598,558 in reported losses, approximately $3.05 billion. These are figures from complaints received by IC3, not a census of all fraud, a count of unique businesses, or an estimate of any particular organization’s likelihood of being targeted. The report also explains that classifications and loss information can change as analysis or investigations develop. FBI IC3 2025 Annual Report, pages 7, 8 and 62.
The number establishes the seriousness of the reported harm. It does not tell a bookkeeper which invoice is fraudulent. That decision still depends on a clear process that works during an ordinary afternoon, with interruptions, overdue tasks and a supplier asking when payment will arrive.
A useful process should be easy to remember without asking people to become forensic investigators. For changed payment instructions, the central habit is straightforward: stop the change long enough to verify it outside the message that requested it.
Make the callback genuinely independent
A callback is only useful when you know where you are calling. A telephone number in the suspicious email, its attachment or its signature is part of the same unverified request. Calling it can turn a written deception into a spoken one.
Use a number already established through previous legitimate dealings, such as an independently verified supplier record. The FBI’s April 2020 guidance specifically recommends verifying payment changes in person or through a known telephone number. The point remains practical: the verification route must not be supplied solely by the request being checked. FBI guidance on cloud email compromise.
If no dependable number is available, pause the payment and establish one through a separate, reliable route. An existing contract or a previously verified business contact may help. Do not treat the first search result, a sponsored listing or a newly supplied contact card as automatic proof. If you cannot establish the recipient confidently, escalate the question rather than guessing.
During the call, confirm more than the fact that an email was sent. Ask an authorized person whether the organization requested a payment change, what the correct destination is and when the change takes effect. Check the beneficiary name and relevant banking details carefully through the agreed secure process. Ask the contact to provide the information from their own records rather than merely agreeing to everything read from the suspicious message.
Keep a short record of whom you reached, how the number was established, when the confirmation occurred and what was confirmed. Store financial details only where the people who need them can access them. A public chat channel or widely shared document is not a suitable verification log.
A call lowers risk; it is not a universal guarantee. Contact records can become stale or be altered, and an incoming caller can claim an identity they do not hold. When the contact route itself has just changed, verify that change before relying on it to authorize a payment.
An ordinary explanation still needs confirmation
Consider this illustrative example, not a reported case or a Foundation transaction.
A small ceramics studio receives a message about payment for packaging already delivered. The message explains that the supplier has moved to a new bank. It contains the correct order reference and asks for payment before the afternoon cutoff. A new telephone number appears beneath the familiar account manager’s name.
The studio owner does not reply to confirm the bank account and does not call the new number. She uses the supplier contact recorded during earlier orders. The account manager says the business has made no banking change. The owner holds the payment and alerts the supplier through that established route. The supplier can then investigate whether its mailbox, a lookalike address or another part of the exchange was involved.
Now change one fact: the supplier really has moved banks. The callback still has a purpose. The owner can confirm the new details, record the effective date and complete the payment through the agreed process. Verification does not require accusing a long-standing supplier of dishonesty.
A useful sentence is: “We check every change to payment details through our existing contact records. I will call the number we already have before updating this.”
The routine protects both sides. A legitimate supplier wants the money to arrive. Applying the same check to familiar and unfamiliar contacts also reduces the pressure to make exceptions for someone persuasive, senior or impatient.
Notice the change that makes the request different
Urgency is a reason to pay attention, but it is not the only warning sign. A message may request secrecy, introduce a different beneficiary, replace a bank account, change the payment method or ask someone to bypass the normal contact. None of these facts alone proves a crime. Each can justify holding the changed instruction until it is checked.
An executive’s name should not exempt a request. The FBI describes BEC examples involving a supposed boss asking an employee to buy gift cards and a familiar vendor sending revised payment instructions. It advises verifying changes in account numbers or payment procedures with the person making the request. FBI overview of business email compromise.
Make room for people to say that the requested check is incomplete. If the usual contact is unavailable, the organization needs an agreed way to hold or escalate the payment. A rule that disappears whenever the deadline is close offers its weakest protection at the moment pressure is highest.
For a sole trader, that may mean setting a personal rule never to update banking details during the same rushed exchange in which they arrive. For a larger team, it may mean flagging the change separately from approval of the underlying bill. The important distinction is between money genuinely owed and a destination not yet verified.
If money has already moved act before the story is complete
Discovering a suspected diversion can bring a rush of embarrassment and fear. The first task is to seek help while there may still be options to interrupt the transfer. You do not need to finish reconstructing every email before making the call.
Contact the sending bank or payment provider immediately through its trusted app, established fraud contact or independently verified number. Explain that the payment may be fraudulent. Provide the transaction time, amount, reference and destination details you have, and ask what urgent recall, reversal or receiving-bank notification steps are available. IC3 specifically advises contacting the originating financial institution promptly and asking about recall or reversal and the relevant indemnity documentation. Let the bank explain its process. Recovery is uncertain and depends on the circumstances. IC3 BEC incident guidance.
At the same time, alert the person responsible for finance and the IT or security contact. The UK National Cyber Security Centre’s business-payment-fraud guidance emphasizes prompt contact with both the bank and the organization’s IT support. If you work alone, use your bank and established technology provider rather than support details supplied by the suspicious sender. NCSC response guidance.
Hold related pending payments while their destinations are checked. Reach the genuine supplier through a trusted channel and explain the specific concern without asserting, before investigation, that their systems caused it. Avoid discussing the response inside a thread that may still be accessible to an attacker.
Keep the original messages, attachments, payment records and a timeline of actions in a secure location. Ask technical support to preserve relevant email headers and logs. Do not circulate a suspicious attachment widely to warn colleagues; share a safe description through the organization’s reporting route.
Report the incident and examine the exposure
In the United States, report BEC through the FBI’s Internet Crime Complaint Center. Its complaint process asks for transaction details and information about what happened. The IC3 FAQ says to retain original evidence securely and explains that it does not accept attachments to complaints. A report may be referred for investigation, but filing does not promise a particular investigation or recovery. IC3 complaint and evidence guidance.
The FTC also directs businesses to ReportFraud.ftc.gov for fake invoices, phishing attempts and other scams. Outside the United States, use the appropriate national reporting service and local law enforcement as relevant. Reporting routes differ; none should replace the immediate call to the bank when a transfer is at risk.
If a mailbox may be compromised, involve qualified support to contain access and investigate what else happened. For Microsoft 365, Microsoft’s current guidance covers blocking access, revoking sessions, checking authentication methods and reviewing applications, mail forwarding and inbox rules. These are platform-specific tasks for the responsible administrator, not a reason to experiment with unfamiliar settings during a crisis. Microsoft guidance for a compromised cloud email account.
The investigation should establish whether other customers received changed instructions and whether confidential information was exposed. Legal, contractual, insurance and notification obligations depend on the facts and jurisdiction. Seek appropriate advice rather than assuming that recovering one payment closes the incident.
Make early reporting easier than hiding a mistake
People need to know what will happen when they raise a concern. A colleague who says “I think the payment went to the wrong account” should hear a clear next step, not an immediate accusation. Criminal deception is the criminal’s responsibility. A fair review can examine decisions and weaknesses without humiliating the person who encountered the attack.
After the urgent response, walk through the sequence. Where did the changed instruction enter? Which contact details were trusted? What made the request feel credible? Could someone hold the payment without seeking permission from the person apparently requesting it? How quickly could they find the bank’s fraud number?
Use the answers to make one or two concrete improvements, then rehearse a short scenario with the people who handle payments. Practice finding the trusted contact, explaining the pause and reporting a suspected loss. Include an example with excellent spelling and a real supplier relationship, so training does not teach people to look only for crude messages.
Reliable commerce depends on trust. Taking a moment to verify a changed instruction helps preserve that trust where it matters: between the people who did the work and the people who intend to pay for it.
If your organization has a practical proposal for accessible fraud-awareness education or support for small organizations, you can start a partnership conversation with Feel Worldwide Foundation. Any collaboration would require review of fit, capacity and responsibilities; this is not an offer of fraud investigation, fund recovery or financial reimbursement. You can also support Feel Worldwide Foundation through a donation, reviewing the available giving purpose and terms. A general gift should not be assumed to fund a particular fraud-prevention activity.
