How Small Businesses Can Stop Payment-Change Phishing

Phishing is no longer limited to obvious spelling errors. Attackers may copy a real conversation, impersonate a manager or supplier, use a lookalike domain, place a QR code in a document or send a link to a convincing sign-in page. Familiar language and branding show that a message is well prepared; they do not prove who sent it.

Google's June 2026 advisory describes adversary-in-the-middle phishing that can mirror a legitimate login flow and capture a session cookie as well as a password. This matters because an attacker with access to a real mailbox can reply inside an existing conversation. The correct defence is therefore both technical and procedural: protect the account, then verify payment instructions outside the conversation.

Treat any change to bank account, wallet address, payment destination or beneficiary name as a new risk event. A routine invoice becomes non-routine the moment its payment instructions change.

First, stop the payment. Do not reply to the message, use its phone number or click its links while trying to confirm it. The FTC advises contacting the company or bank through a phone number, email address or website you already know is genuine.

Second, retrieve the supplier's trusted contact details from your accounting system, signed contract, previous verified invoice or official website. Call a known contact and ask them to confirm the full beneficiary name, bank name and the final digits of the account. If the usual contact is unavailable, wait or escalate through another established channel.

Third, compare the request with earlier records. Look for a new domain, changed reply-to address, altered invoice numbering, an unfamiliar beneficiary or a payment destination in a different country. A difference is a reason for more checking, not automatic proof of fraud.

Fourth, require a second authorised person to review the evidence and approve the change. The requester, verifier and final approver should not all be the same person for a high-value payment.

Fifth, record who requested the change, when independent verification occurred, which trusted contact confirmed it and who approved the payment. This creates a repeatable control instead of relying on memory.

Turn on multi-factor authentication for email, accounting, cloud storage and payment accounts. Where available, use phishing-resistant methods such as passkeys or security keys instead of codes that can be relayed through a fake sign-in page.

Give each person an individual account and the minimum access required for their role. A staff member who prepares invoices may not need authority to change payees or release funds. Remove former workers and unused integrations promptly.

Keep devices, browsers and security software updated automatically. Use a password manager to generate a unique password for every important account. Review forwarding rules and recovery methods after any suspicious sign-in because attackers sometimes create persistence inside a mailbox.

These controls reduce the chance of account takeover, but they do not replace independent payment verification. A message sent from a genuine compromised account can still be fraudulent.

A long security policy is less useful than a rule people can remember during a busy workday: no payment-detail change is approved from a message alone. Put that sentence beside the payment checklist and include contractors who handle invoices or customer support.

Run a short exercise using a fictional supplier request. Ask the team to identify the trusted contact, explain how they would verify the change and name the second approver. The goal is to practise stopping safely, not to embarrass someone who misses a clue.

CISA recommends teaching employees to recognise and report phishing. Make reporting simple: one shared email address, chat channel or named person. Thank people for raising suspicious messages quickly, including false alarms.

If a suspicious payment has been sent, call the bank or payment provider immediately using an official number and ask whether the transfer can be recalled, frozen or flagged. Speed matters, so the response contact and account reference should be available without searching through old messages.

Preserve the original email, headers, invoice, chat history, payment receipt and timeline. Do not delete the compromised mailbox before evidence and essential business records are secured. Change affected passwords from a clean device, revoke active sessions, review forwarding rules and confirm recovery details.

Report the incident to the appropriate national cybercrime or fraud authority. In the United States, the FBI directs BEC victims to contact their financial institution immediately and report the event to the Internet Crime Complaint Center. Businesses elsewhere should use their bank's fraud team and the official reporting channel in their country.

Notify affected customers or suppliers when their information or relationship is being impersonated, but confirm legal and contractual notification duties with qualified local advice. After containment, document the control that failed and improve that specific step.