Treat the change as the thing to verify
A familiar name, accurate invoice number or convincing email thread can create false reassurance. A payment request deserves a fresh check when the destination account changes, a new recipient appears or someone asks you to bypass the usual process.
Do not reply to the suspicious message to ask whether it is genuine. Use a contact route you already know independently, such as a previously verified telephone number. A number printed in the new invoice is part of the request you are checking, not independent confirmation.
Check the instruction and the authority
Confirm who requested the change, what payment it concerns and whether that person is authorised to request it. For businesses, follow your established payment-approval process even when the sender claims to be a director or a senior client.
Urgency is a reason to make the check more disciplined. A short delay to verify a large transfer is usually easier to explain than a payment sent to an unconfirmed account. Record who performed the verification and how, so someone else can follow the decision.
- Compare the account change with the original contract or agreed process.
- Confirm through an independently obtained channel.
- Use a second authorised approver where your payment controls require one.
- Record unresolved differences and keep the payment on hold until resolved.
If money has already been sent
Contact your bank promptly using its official contact details. In a business, tell the relevant IT or security contact as well as the finance lead; the issue may involve an email account or wider system compromise. Keep the payment reference, original request and relevant messages.
Reporting and recovery steps should not wait for a private investigation. Ask the bank about its process and record the reference it provides. Avoid paying someone who unexpectedly promises recovery for an advance fee.
Create a repeatable check
Free first step: write a one-paragraph rule for changes to payment details and agree who can approve an exception. Rehearse it with a harmless example so everyone knows where to find the trusted contact information.
If the immediate response is underway but the origin, pattern or wider exposure remains unclear, PDC can discuss an investigation brief. Tell us what is known, what has been reported and what question remains; no investigator can promise that funds will be recovered.
Questions you may have
Does a genuine email address make the request safe?
No. An account or thread may have been compromised. Verify important changes through an independently known channel.
Should I ask PDC before contacting my bank?
If you suspect a fraudulent payment has been made, contact your bank promptly. A private enquiry should not delay the bank’s response.
Sources & further reading
Check the original sources for their latest information and service terms.