Verify before changing payment details
A request to change a supplier’s bank details should stop a payment long enough for an independent check. Call the supplier through an established number, confirm the request with an authorized contact and record who verified it before updating the account.
The Federal Trade Commission’s small-business phishing guidance warns that familiar names, convincing logos and urgent messages can disguise fraud. Its practical advice is to contact the supposed sender using a number you already know is correct, rather than one supplied in the suspicious message.
For a restoration office, the pressure may arrive between emergency dispatches and payroll. A familiar vendor name does not resolve the question. Treat a new payment destination as a separate decision from approving the underlying invoice.
Make the verification repeatable
Create a short procedure that assigns responsibility for receiving a request, verifying it and approving the change. Keep the established contact information outside the incoming message. Where staffing permits, separate verification from the final payment release so one hurried employee does not control every step.
Ask the supplier to describe the change through the established contact, rather than merely agreeing with details you read aloud. Record the date, contact method and approval in the vendor file. Avoid putting complete banking information in an ordinary email thread or a broadly shared job folder.
Consider a hypothetical equipment supplier whose invoice arrives with a note saying its banking arrangements changed overnight. The office manager recognizes the invoice number, but that proves only that the message contains familiar information. Calling the number already in the vendor record provides a different channel for checking the request.
If the regular contact cannot be reached, hold the change and escalate it internally. A claimed deadline should trigger a conversation with the owner or finance lead, not an exception that quietly removes the verification step. Tell dispatch staff who can make that decision during an evening or weekend emergency.
Plan for a suspicious message
The FTC also recommends asking colleagues about unusual requests and following company procedures if someone has shared information with a suspected scammer. Build those reporting instructions into onboarding so an employee can raise a concern immediately without first proving a fraud occurred.
Write down the first internal contact and the payment provider’s established reporting channel. If a transfer may have gone to the wrong destination, promptly contact the financial institution through a trusted number and follow its response instructions. Preserve the message and relevant transaction records for the investigation.
Review the vendor contact record when a legitimate staffing change occurs, using the same independent checks. Otherwise, a procedure can appear complete while still directing employees to an outdated number or an individual who no longer has authority to confirm payment instructions.
Test the process with a hypothetical request during a staff meeting. Can a new employee find the trusted vendor contact, identify the approver and document a hold? Use the answers to close gaps in the procedure. Pair this payment control with restoration business continuity planning so the office can maintain essential controls when work becomes hectic.
