An invoice arrives from a supplier you recognize. The amount looks plausible, the signature looks familiar, and the message asks you to use new payment details. The most important security step may happen away from that email: verifying the request through a trusted channel.
At User Friendly Security, we recommend combining account and computer protection with a repeatable payment-checking process. Software can help identify some threats, but it cannot decide whether a real-looking invoice matches work you actually authorized.
A familiar sender does not prove the request is genuine
A scammer may imitate a company’s address or send from a mailbox they have compromised. A reply in a familiar conversation can therefore still carry a fraudulent request. The FBI describes this kind of deception as business email compromise.
For a hypothetical example, imagine an ordinary supplier invoice followed by a note saying its bank has changed. The logo and old conversation do not validate the new account. Treat the change as a separate request that must pass your normal checks.
Match the invoice to something you expected
Before opening an attachment, ask who ordered the work, which service or delivery it covers, and whether the amount and timing fit. Check your own records or an independently opened supplier portal. A demand that nobody remembers authorizing needs investigation, not a hurried payment.
Do not call a cancellation number in an unexpected invoice to challenge a charge. An invoice can be bait for a fake support conversation even when no charge has happened. Contact the business using details already in your records or its independently verified website.
Verify payment changes outside the email thread
Use a phone number you already trust or find independently, not one supplied in the suspicious request. Ask the known contact to confirm the invoice and any change in account or payment procedure. Do not rely solely on a reply to the same thread.
For a small team, a second approval for new payment instructions can create a useful pause. Decide who is allowed to change supplier records and how that change is documented. These are practical workflow safeguards, not a guarantee against fraud.
Do not let urgency remove the checking step
Pressure to avoid a late fee, keep a service running or keep the transaction secret should increase attention. A genuine deadline is a reason to contact the supplier promptly through a trusted route, not a reason to skip verification.
Keep the question neutral: We are confirming changed payment instructions using our usual process. That is easier for staff to follow than an instruction to judge whether every email sounds suspicious. Make it acceptable to pause and ask.
Treat links and attachments as a separate risk
An unexpected PDF, shared-document link or sign-in screen can present an account or device risk even if no payment is made. Open a known supplier portal directly when possible. Never enter an email password or verification code simply because an invoice page asks for it.
If you already interacted, use our suspicious-link response guide. Opening a page, sharing credentials, installing software and sending money require different next steps. Preserve the message and note what happened.
If money or account access has already been shared
Contact your bank or payment provider immediately using its official channel, explain the suspected fraud and ask what recovery or blocking options are available. Recovery is not guaranteed. The FBI directs business email compromise reports to IC3; the FTC also provides steps after a scam.
If credentials were exposed, secure the account through its official website from a trusted device. Review sessions, recovery details and our unfamiliar forwarding-rule checklist. A password change alone does not confirm every unwanted access path has been removed.
Use layered protection without outsourcing the decision
Managed computer protection, current software and eligible email filtering can reduce exposure to some malicious activity. They do not authorize a payment or guarantee that every convincing message will be blocked. Our harder-to-hack checklist covers the wider account and device habits.
Want to understand the computer-protection side? Compare User Friendly Security’s plans and review the inclusions and optional services before enrolling. Payment verification remains part of your own business process.
Official sources
FBI: Business Email Compromise · FTC: Small-business invoice scams. Reviewed October 20, 2026.