A genuine supplier can change banks, but compromised email accounts make detail-change messages especially risky. A consistent verification rule protects both sides without accusing anyone.
Assume the message is not proof
Do not reply to the same email asking if the change is genuine; an attacker controlling the mailbox can simply confirm it. Call a known contact on a number from your own records or the organisation’s official website. Ask them to state the new details and explain the effective date.
Protect the first payment
Record who verified the change, when and through which channel. For a large or unusual transfer, consider an additional authorised check under your organisation’s policy. Never let a deadline or threat of late fees override a destination mismatch or unresolved warning.
A practical next step
- Use a trusted contact method unrelated to the change request.
- Record the confirmation and re-check the final destination name.
- Escalate large or unusual payments for a second review.
Good to know: This is general information, not financial advice. Bill Pay is currently an interactive front-end prototype; it does not move money, connect to a bank or verify payment destinations.