Is replying to the supplier’s email enough to verify bank details?

No. If the mailbox or conversation has been compromised, replying can keep you in contact with the wrong person. Use a trusted telephone number or another independently established channel already in your records. Follow your approval process before changing banking details or releasing a payment, even when the message appears familiar.

Should an urgent request from the owner bypass payment checks?

Your process should define how urgent requests are handled and who can approve an exception. A familiar name or senior title is not independent verification. Train backup approvers as well as regular finance staff so the same checks remain usable when someone is away or a payment deadline is close.

Financial Phishing: Verify Before Sending Money

This guide was originally published on 2022-03-15. Its guidance was substantially updated on October 2, 2026.

Separate the request from the verification

The FTC recommends confirming emailed transfer requests through another channel. Use a number already held in trusted records, rather than one supplied in the message requesting the change. A reply to the same email thread does not provide independent confirmation.

Decide who can request a supplier change, who verifies it and who authorizes payment. That separation should be clear to a temporary employee or backup approver as well as the person who handles invoices every day.

Practice the awkward conversation

Give employees permission to slow a request down. A useful practice example is a supplier asking for new banking details shortly before a payment run. Have the employee explain the verification step, locate the trusted contact and record the approval without using confidential customer information in a training exercise.

Check what happens when a request appears to come from the owner. Seniority should not silently remove the verification step. If exceptions are allowed, define who approves them and how they are recorded.

Connect the process with account security

Review access to shared finance mailboxes and who can change payment records. Email filtering, sign-in protections and permissions support the process, but they do not make every incoming request trustworthy.

If money has already been sent, contact your financial institution promptly through its known contact details and follow your incident process. Do not send another payment because the same correspondent promises to reverse the first one.

Talk through the next step

Cyber Shift has 73 five-star Google reviews, with a 5.0 average. Book a 30-minute call with our North Canton team about the email filtering and sign-in protection that support this process.

Reference: official guidance.