Picture a Friday afternoon. A regular supplier emails an updated invoice with a new bank account. A few minutes later, someone who sounds like your CFO calls to say the change is real. The request is familiar, the deadline is close, and the payment is already queued.
That is exactly when a good process should slow things down. A familiar email address, caller ID, or voice is not enough to approve new payment details.
The FBI’s Internet Crime Complaint Center describes business email compromise (BEC) as a scam that can involve criminals taking over a legitimate business email account and using it to redirect a transfer. The FBI advises businesses to verify account changes through a secondary channel. The FTC also warns that phishing messages can imitate vendors, clients, and coworkers, and recommends calling a number you already know is genuine.
Voice impersonation adds another reason to verify. In a separate alert about an impersonation campaign, the FBI warned that AI-generated voice messages can be difficult to distinguish from a real person. That alert was not specifically about vendor invoices, but it points to a useful rule: recognizing a voice should not be your payment control.
Make this routine easy to follow. Keep verified vendor contacts somewhere accounts payable can find them, document how payment changes are approved, and make it acceptable for employees to take a few minutes to check a request. A short pause is cheaper than trying to recover a transfer.
Contact your financial institution immediately and ask whether it can recall or reverse the transfer. The FBI’s IC3 recommends acting as soon as fraud is recognized and filing a detailed report. Preserve the original email, invoice, phone number, and any messages so your bank and investigators have the details.
The simple rule is worth sharing with everyone who handles invoices: new payment instructions must be verified through a trusted, separate channel before money moves.
If your team would like help reviewing its email security and payment-change procedures, talk with Technic about cybersecurity and compliance support.
