You receive a message with an invoice, a new bank account number or a request for fast payment. Before acting, compare the details with earlier arrangements. If anything has changed, confirm it using a contact you knew before receiving the message.
Do not use a telephone number found only in the suspicious email. Your question could reach the same person who sent the fake request.
Check the request itself
Look for a changed account number, an unusual payment recipient, a new payment destination or instructions to bypass normal approval. Compare the message with the order and documents you are authorised to access.
CERT Polska recommends confirming requests for money through another channel. A message’s appearance is not enough to make the decision. Phishing guidance.
An urgent deadline alone does not prove fraud. It is a reason to follow the normal procedure even under time pressure. A legitimate request to change bank details also needs checking.
Keep verification separate from the suspicious message
Use a number already recorded in your business documents or an agreed contact channel. Ask about the specific change and the person who approved it.
During the conversation, do not provide passwords, sign-in codes or information that could enable account takeover. If the message asks you to sign in, check the service address independently of the link. CERT Polska advises checking the website’s domain before entering data. CERT Polska guidance.
If you cannot confirm the request, pause the decision and refer it to the person responsible for payments. Do not mark it as verified simply because the message looks familiar.
Agree a rule before the next urgent invoice
In a small business, establish who can approve a bank account change and which contacts they use to verify it. Also document what the person covering for an absent owner should do.
A sample rule could be: “We confirm a new bank account through a previously known contact and record who approved the change.” Adapt it to your actual payment process. This is a suggested procedure, not a guarantee of stopping every fraud attempt.
Account protection and payment verification are two areas to address in your working practices. MFA does not assess whether an invoice’s content is genuine.
If sign-in details have already been disclosed, action is needed for the specific service. Use its official recovery procedure and the appropriate response route; checking the next message alone does not undo the incident.
CyberKlucz can help organise access to important accounts within an agreed scope. The first conversation can cover who uses email, their permissions and how recovery works. Do not send confidential customer messages or passwords in an ordinary enquiry.
