Payment Request Email Scam? 60-Second Checklist

Verify every unexpected payment-detail change outside the email thread before a transfer is approved.

Quick answer: treat any unexpected payment request, bank-account change or "urgent transfer from the director" as suspicious until you confirm it through a different channel. Do not reply to the email, do not click its links, and do not call a phone number that appears only in that message. Look up the contact in your own records (the contract, the supplier master file or the official website), call it, and have a second person approve before money moves.

This kind of fraud is usually called business email compromise (BEC) or invoice redirection. The attacker does not need to hack your bank. They only need one believable email that gets someone with payment authority to change a beneficiary account. This guide gives finance and admin teams a checklist they can run in 60 seconds, a call-back script, a role-by-role split of who checks what, and a first-hour plan if a transfer has already gone out.

How big is this problem?

The FBI's Internet Crime Complaint Center (IC3) defines business email compromise as "a sophisticated scam that targets both businesses and individuals who perform legitimate transfer-of-funds requests", frequently carried out by compromising a legitimate business or personal email account through social engineering or computer intrusion. Some figures from its public alert of 9 June 2023 (alert number I-060923-PSA):

• Between October 2013 and December 2022 the IC3 recorded 277,918 domestic and international incidents, with $50,871,249,501 in exposed dollar loss.
• The scam had been reported in 177 countries, with more than 140 countries receiving fraudulent transfers.
• Between December 2021 and December 2022, identified global exposed losses rose 17%.
• The FBI says the scam targets "small local businesses to larger corporations, and personal transactions", and that it is not always a transfer request: some variants ask for employees' personal information, tax forms or cryptocurrency wallets.

Two cautions. These are US-centred figures, and "exposed dollar loss" means money involved in reported cases, not money confirmed lost. We found no comparable official figure for Vietnam, so this guide does not give one.

The FBI also describes how the redirection works. In its real-estate example, once criminals gain access to a participant's mailbox they can monitor the transaction and time a request to change the payment type, or to move from one bank account to another account they control. The setting differs from your supplier invoices, but the mechanism is the same: read the real conversation, then step in just before money moves.

The 60-second checklist

The checklist, red flags, call-back script and role split in this guide are our own recommended process. They are built around the FBI's advice to verify changes in account information through a secondary channel, but they are not quotations from the FBI.

Run these five checks in order. Stop at the first "no" and escalate.

Check	What to do	Safe decision
1. Is the sender really who they claim?	Expand the full address, not the display name. Compare it character by character with a past genuine email.	Stop if the domain is similar but not identical (for example one letter swapped, or - added).
2. Is the request normal for this supplier?	Compare it with the previous invoice, the contract and the usual payment process.	Never accept new bank details from a single email.
3. Is there pressure?	Look for "urgent", "confidential", "pay today", "I am in a meeting, do not call".	Pressure never replaces verification; it is a warning sign by itself.
4. Does it ask you to click or open something?	Do not open unknown attachments, login pages or QR codes in the message.	Go to the known official website or app yourself.
5. Was it confirmed independently?	Call a number you already hold, or message through a known internal channel.	Require a second approver for any change in beneficiary details.

Print this table and keep it next to the payment approval screen. A checklist only helps if people can see it at the moment they decide.

Seven red flags that show up repeatedly

Attackers copy normal business language, so look for patterns rather than bad grammar:

1. A change of bank account for an existing supplier, especially to a different bank, a different city or a personal name.
2. An invoice that looks right but arrives from a slightly different address, or in an existing thread that has a new participant added.
3. A request to keep it confidential ("do not discuss with the team until the deal is announced").
4. A senior person asking for an urgent transfer or gift cards while "unreachable by phone".
5. A request to change the delivery or contact details a few days before a large invoice is due.
6. A "reply-to" address that differs from the sender, so your reply goes to the attacker even if the sender looks correct.
7. A message that reuses real details: invoice numbers, amounts, project names. This usually means a mailbox has already been compromised, either at the supplier or inside your company.

Point 7 matters most. If the message contains real invoice data, the attacker may be reading a real mailbox, so verifying by replying in the same thread is the one thing you must never do.

Step-by-step safe workflow

1. Pause the payment and keep the evidence

Do not delete the email. Save it as a file (in Outlook, drag it to the desktop to keep the headers) and note the time you received it. This helps your bank and IT team later.

2. Compare against your own records

Open the supplier master file or the signed contract and compare name, tax code, bank name, account number and account holder. If any of these differ, the request needs written verification, not a quick approval.

3. Call a number you already trust

Use the phone number from the contract, your supplier directory or the supplier's official website. If you cannot find an independent number, ask your account manager or a senior colleague who has dealt with the supplier before. Never use a number from the suspicious email or its signature. This matches the FBI's advice to "use secondary channels or two-factor authentication to verify requests for changes in account information". The FBI also advises checking that links in emails belong to the business they claim to be from, watching for misspellings of the real domain name, and verifying the sender's address, "especially when using a mobile or handheld device".

4. Use a call-back script

A short script keeps the call from becoming a social-engineering conversation. Say:

"I am calling to confirm a change to your bank details before we pay invoice [number] for [amount]. Please tell me the bank name and the last four digits of the new account, and the name of the person who authorised the change."

Do not read out the new account number yourself. Let the other side say it, then compare it with the email. A genuine supplier is happy to confirm; an attacker's phone number usually leads nowhere or to a person who becomes vague.

5. Get a second approver

For any change of beneficiary, or any payment above a limit your company sets, require a second person to review the evidence. The second person should see the verification notes, not only a "please approve" message from the first.

6. Report the message to IT

Even when you stop the payment, report the email so IT can search other mailboxes for the same message and check whether any account was used to send it. Our guide on how to report a phishing email in Outlook and Microsoft 365 shows the exact steps.

7. Release the payment only after the process is complete

Record who verified, how, when and which number was called. This record is your protection if a dispute arises, and it makes the next audit simple.

Who checks what: a simple role split

Small companies often let one person do everything. Splitting the duties, even across two or three people, removes the single point of failure that these scams depend on.

Role	Responsibility	Never allowed to
Requester / accountant	Receives the invoice or change request, runs the 60-second checklist, makes the call-back	Approve their own change of beneficiary
Approver (manager or owner)	Reviews the verification notes and approves the payment	Approve based on an email or chat message alone
IT or the IT provider	Checks the email headers, searches other mailboxes, resets accounts if needed	Be skipped when a suspicious message is reported
Bank liaison	Contacts the bank immediately if a bad transfer is found	Wait for "more information" before calling

Write the four roles into a one-page procedure and name the actual people. A rule that nobody owns is not a control.

Controls that make these scams harder

The checklist is the human layer. The UK National Cyber Security Centre (NCSC) argues for a multi-layered approach to phishing, and its published case study shows why. A company of about 4,000 staff received 1,800 emails posing as an urgent invoice. Email filtering stopped 1,750 and 50 reached inboxes. 25 were reported, some only after being clicked, which was the first sign the attack had got through. The NCSC concludes that "reliance on any single layer would have missed some of the attacks". That case was malware, not payment redirection, but the lesson about layers and early reporting is the same.

The controls below are our suggestions, not NCSC or FBI requirements. They reduce how often the message reaches a person at all:

• Multi-factor authentication on every mailbox, especially finance and executive accounts. A stolen password alone should not let an attacker read invoices. See MFA and passkeys for small business.
• Email authentication (SPF, DKIM, DMARC) on your own domain so that attackers cannot easily send mail that appears to come from you.
• External-sender warning banners so messages from outside the company are visibly marked.
• Mailbox rules review: attackers who get into a mailbox often add a hidden forwarding rule. IT should check for unexpected rules and forwarding in affected accounts.
• Payment limits and dual approval in the banking system for new beneficiaries.
• A supplier master file that only a named person can edit, with a log of changes.
• Short, regular exercises: send a safe test message such as a payment-detail-change request and see whether staff follow the process. The goal is to practise the first decisions, not to blame anyone.

For a broader security baseline for Microsoft 365, read Microsoft 365 security hardening for small business.

What not to do

• Do not reply to the suspicious thread to ask whether it is genuine.
• Do not test a suspicious link or attachment "just to see".
• Do not change supplier payment details because of a single email, even one from a known contact.
• Do not give passwords, MFA codes or one-time passcodes to any caller or sender, including someone claiming to be from your bank or IT.
• Do not delay reporting out of embarrassment. Speed is what decides whether a transfer can be recalled.

If money has already been sent: the first hour

The FBI says that if you discover a fraudulent transfer, "time is of the essence". Recovery is never guaranteed, and the FBI notes that financial institutions have varying policies, so it is worth knowing in advance what help your bank will give. Steps 1 and 6 follow the FBI's advice; steps 2 to 5 are our own recommendations.

1. Contact your bank first. The FBI's advice is to contact your financial institution and request a recall of the funds along with any necessary indemnification documents. Use the fraud-line number on the bank's official site or your account documents, and give the transaction time, amount, beneficiary account and reference.
2. Tell management and the person responsible for finance, so that no further payments to the same account go out.
3. Preserve evidence: the original email (with headers), call logs, the invoice, and the bank confirmation.
4. Ask IT to check the mailboxes involved: reset passwords, revoke active sessions, enable MFA if missing, and look for forwarding rules and unusual sign-ins.
5. Contact the genuine supplier using a trusted number, so they can check whether their own mailbox was compromised.
6. Report the incident. The FBI asks victims to file a complaint at ic3.gov as soon as possible regardless of the amount, but that is a US channel. We have not verified an official reporting channel in Vietnam, so this guide names none: ask your bank and your local police, and tell your insurer if you have cyber cover. Check your own legal obligations, because reporting duties differ by company and by the type of data involved.

If the fraud involved a compromised Microsoft 365 account, recovering a hacked business email account explains the account-side recovery steps.

Turn this guide into a company process

After handling the issue once, record three things: the owner, the reporting channel and the response target (for example "report within 15 minutes"). Then store the checklist and call-back script where the finance team already works, such as the shared drive or the payment approval tool, and review it twice a year.

Review access rights, former-employee accounts, inactive devices and file-sharing rules regularly too. These controls often decide whether a small incident stays with one user or spreads across the company. See our IT security services, Microsoft 365 services, or request a free IT assessment.

Frequently asked questions

Does a familiar supplier name prove the email is real?

No. Display names are easy to fake, and the real sender address can be hidden behind them. Check the full address, then verify through a trusted independent contact.

What if a supplier genuinely changed bank accounts?

Verify it independently by calling a number you already hold, get the change in writing on the supplier's letterhead, have a second person approve it, and record the evidence. A genuine supplier will expect this.

What if the request comes from my director or CEO?

Treat it the same way. The FBI notes that these scams are frequently carried out by compromising legitimate business or personal email accounts, so a message that comes from a genuine-looking senior account proves nothing by itself. Call the person on their known number or confirm face to face; never reply to the email to check.

What if money has already been transferred?

Call the bank's fraud line straight away, tell management, preserve the evidence and ask IT to check the accounts involved. Speed gives the best chance of a recall, though recovery cannot be promised.

Can IT stop every payment scam?

No. Email filtering and authentication reduce how many fraudulent messages arrive, but a well-written message can still get through. Independent payment verification and trained staff remain essential.

Are small businesses really targeted?

Yes. The FBI says the scam targets "small local businesses to larger corporations, and personal transactions". Our own observation, not a quoted finding, is that small finance teams often have fewer checks in place.

Is a QR code in an invoice safe to scan?

Not unless you have confirmed the invoice independently. A QR code hides the destination address, so you cannot check it the way you can check a link's domain name, which the FBI advises doing. Open your bank app or the known official site yourself instead. (The QR-code point is our reasoning, not a quotation.)

Sources and date checked

The statistics and advice attributed to the FBI and the NCSC come from the pages below, opened and checked on 15 October 2026. If anything differs, the original page is the authority:

• FBI Internet Crime Complaint Center (IC3): Business Email Compromise: The $50 Billion Scam, alert number I-060923-PSA, 9 June 2023 (data from October 2013 to December 2022).
• UK National Cyber Security Centre (NCSC): Phishing attacks: defending your organisation, published 5 February 2018, reviewed 13 February 2024, version 2.0.

Not verified in this article: loss figures, reporting channels and bank recall practice in Vietnam; BEC statistics newer than December 2022 (the newer FBI page we tried returned 404); and FTC and CISA guidance (those pages did not load). The 60-second checklist, the seven red flags, the call-back script, the role split, the extra technical controls and steps 2 to 5 of the first-hour plan are our own recommended practice, not quotations from the FBI or the NCSC.

Next step

If this problem is recurring, affects sensitive data, or has no clear owner, ask for an assessment that turns the steps above into a process with named people. Contact Vietify IT Services for help with email security checks, Microsoft 365 configuration, process setup and incident response, or start with a free IT assessment.

Vietify IT Services — IT and licensed software partner for businesses in Da Nang. Updated: 15 October 2026.