Payment fraud rarely looks like fraud. It looks like a busy director, a supplier tidying up their accounts, or a reply in a thread you half remember. Here are the five versions we see most, and the one check that stops all of them.
In short
Do not trust unexpected requests.
Do not act on urgency alone.
Always verify using a contact method you already hold.
1. The urgent payment request
"Hey, I'm tied up in meetings. Can you urgently process this payment today? Details attached. Keep this confidential."
Urgency, secrecy and a payment outside the normal process. Do not reply to the email. Call the person on a known number and ask: "Did you request this payment?"
2. The changed bank details
"We've updated our bank details. Please use the new account for future invoices."
No prior discussion, and an invoice attached. Do not use the new details. Ring the supplier on the number you have always used and confirm the change out loud.
3. The account alert
"Your account has been compromised. Click here to reset your password immediately."
Fear, plus a link to a login page. Do not click. Open your browser, go to the service directly, and check for alerts there.
4. The hijacked thread
An email arrives as part of an existing conversation with a supplier, complete with the full chain and the invoice: "Hi, just checking on this payment below. Can you confirm when it will be processed?"
A convincing thread does not make a trusted request. Check the sender's address character by character, and do not pay from the email alone.
5. The message from the boss's "new number"
"Hi, it's me. I've lost my phone and I'm using a temporary number. I need a quick favour." Then: "Can you urgently process a payment or buy gift cards? I'll explain later."
An unknown number, an urgent request, and a reason they cannot take a call. Call them on the number you know.
The 30-second check
Every one of these falls over at the same point: a phone call to a number from your own records. If the request is genuine, the person confirms and you have lost half a minute. If it is not, you have saved the business a painful conversation with the bank.
Write it into your process so nobody has to feel awkward about doing it: any new payee, changed bank detail or out-of-pattern payment gets a call first.
Want this to be someone else's job to worry about?
We set up the mail filtering, the payment-change process and the staff training that make these scams bounce off. Talk to us, or see cyber security and audit readiness.