Before you change where a supplier payment goes

Before changing a supplier's payment destination, verify the instruction through a contact route established independently of the request. A reassuring reply in the same email thread is still an answer from the channel you need to check.

Consider an invented community theater. It has received the agreed lighting equipment and owes its supplier $2,400 on Friday, May 14, 2027. The invoice and delivery receipt match. Nora, the accounts coordinator, can prepare that invoice for payment. Changing a supplier's payment record requires a separate authorized review.

On Thursday morning, a message arrives in the familiar invoice thread asking to update the supplier record and use a different bank destination. The amount and due date are unchanged. The message includes a new telephone number for confirming the details.

Which confirmation is independent?

Nora could reply in the thread and receive “Yes, that's correct.” She could call the new number and hear the same thing. Neither answer would establish that the supplier requested the change: both routes were supplied by the request she is trying to verify.

The FBI's guidance on business email compromise describes messages that appear to come from known sources and access to legitimate billing threads. It recommends verifying changes to payment instructions and obtaining a telephone number independently of a questionable message.

Nora instead uses the supplier's verified finance contact held in the theater's supplier file before Thursday's message. That route leads to Ellis, the supplier's finance lead, whose role includes confirming payment-instruction changes. A person who can confirm that equipment arrived would not necessarily be able to answer this different question.

The FBI's March 2021 notification, written for state, local, tribal and territorial governments, specifically recommends known or on-file telephone numbers rather than numbers supplied in emails.

A filled note before the next action

In this fictional branch, Ellis says the supplier has not requested a change. Nora records that answer and retains the request for the person responsible for reviewing it. She does not change the supplier record or prepare payment to the requested new destination.

Invoice and obligation

LT-214; $2,400 due May 14. Agreed equipment received; invoice and delivery receipt matched.

Proposed change

Replace the payment destination for this invoice and the supplier record. No change authorized or entered.

Independent route

Verified supplier finance contact in the theater's existing supplier file, established before the May 13 request. The new number in the message was not used.

Person and fact confirmed

Ellis, supplier finance lead: the supplier did not request the change.

Record made

Nora; May 13, 2027, 9:20 a.m. Request and call note retained with LT-214 in the existing private invoice records.

Next responsibility

The theater's finance manager reviews the conflicting instruction. Supplier record unchanged; proposed new destination on hold.

Payment state

Not sent. The matched invoice remains due; authorization and execution remain separate.

The supplier has disputed the instruction. The note does not identify who sent it. Nora leaves that question with the responsible reviewer rather than accusing a supplier employee.

If the contact cannot be reached

In another branch, Nora cannot reach the appropriate supplier contact. The result is unverified, not confirmed by silence. A familiar thread, the deadline and the owner's general approval of a valid invoice do not answer the destination question.

Nora can still match the invoice, preserve the request and prepare the ordinary supporting records. The finance manager handles the unresolved payment timing through the theater's established process. Urgency has not granted permission to use the new destination.

If the appropriate contact confirms a genuine change, Nora still needs authorization to update the supplier record and prepare payment under the theater's usual checks.

Keep a verification record that answers four questions: what would change; which independently established route confirmed it; who had the relevant role and what they confirmed; and which authorized action remains unfinished. Keep the sensitive details in the existing private records. “Confirmed by phone” alone would leave the next person guessing what was actually established.