Recognise requests that change the normal process
Notice unexpected bank-detail changes, confidential payment instructions and requests bypassing approval. Criminals can impersonate suppliers, executives or advisers. They may reply inside a genuine conversation after gaining account access, so an accurate subject line and familiar history do not establish legitimacy.
Treat urgency and authority as reasons to follow verification, not abandon it. Familiar writing and genuine-looking documents can be copied. A message from a real account may still be fraudulent. Check the requested change, the unusual timing and the attempt to remove another approver rather than relying only on spelling mistakes.
Verify payments through an established contact
Before changing bank details or making an unusual payment, call an established contact using a number held in trusted records. Do not use a number supplied in the request, attachment or linked page. Record the verification independently of the email conversation that triggered it.
Apply the same checks to telephone, video and messaging instructions. A familiar voice is not proof of identity where voice cloning is possible. Follow the agreed callback and approval process. Ask leadership to support this visibly so staff know verification is expected even for apparently senior instructions.
Support people with controls and clear authority
Separate payee-record changes from payment approval where practical. Set proportionate thresholds and identify who authorises exceptions. Make explicit that colleagues may pause a transaction to verify it. The process needs a workable fallback when the usual manager is travelling or unavailable.
Protect mail accounts with suitable MFA and investigate suspicious forwarding rules or access events. These safeguards complement payment checks. A training session or warning banner cannot guarantee recognition of fraudulent instructions. Technical responders and finance need an agreed hand-off when a suspected compromised mailbox is involved.
Respond promptly if something may be wrong
If a suspicious payment was made, contact the bank immediately through a trusted route and notify your incident lead. Ask about available recall or recovery procedures. Do not wait for a completed investigation; recovery is not guaranteed, but delay can reduce the available options.
Preserve messages and payment details for authorised responders. Do not confront the suspected sender in the same thread. Support anyone who acted on the request because candid reporting helps containment. Compass is available now; this page does not claim platform detection or payment-fraud prevention.