Everyday security
An invoice looks legitimate. What should you check before paying?
Check that the purchase was approved and verify any change to payment details through a known supplier contact.
The invoice uses your supplier's logo. The amount looks reasonable, and the email refers to a project your team recognizes. Then you notice a short note: the banking details have changed.
That is a reason to pause the payment and verify the change. An invoice can look entirely convincing while directing the money to the wrong account.
The Canadian Anti-Fraud Centre describes payment-redirection fraud in which criminals impersonate executives or contractors, sometimes after gaining access to email correspondence. Its advice includes verbal verification of urgent requests and changes to payment details.
Confirm the business actually owes the money
Match the invoice to an approved purchase, agreement or other record of the work. Ask the person responsible for the order to confirm that the goods or services were received and the amount is expected.
Check for duplicate invoice numbers and payments already made. A recognizable supplier name does not establish that this particular invoice is valid.
Verify changed payment instructions separately
Call a known supplier contact using a number already held in a trusted record. Do not use the new phone number printed on the invoice or supplied in the email asking for the change. Replying to that same email is not an independent check.
Confirm the request through your established supplier-verification process. If the usual contact cannot be reached, hold the change and escalate it to the person authorized to decide what happens next.
Suppose a replacement invoice arrives for work already approved. The amount is unchanged, but the account number is different. The original approval covers the purchase. The bank-account change still needs to be verified.
Check the email without relying on appearances
Look at the actual sender address and any reply-to address. An unexpected domain, unusual attachment or sudden request for secrecy deserves attention. However, a message from the correct address can still come from a compromised account.
Even a familiar signature and an existing email conversation cannot verify a bank-account change.
Keep approval and supplier changes controlled
Decide who can change supplier records and who can release payments. Where staffing allows, have a second person review changes to banking information. Record who verified the change, how it was checked and who approved it, using your approved business system.
Build cover for holidays and absences into that process. Staff need a way to escalate a deadline without being expected to improvise a new payment procedure.
Support staff who pause a payment
Tell staff that a reasonable verification delay is supported, including when the request appears to come from an owner or senior manager. Practise the process with the people who handle invoices.
If money has already been sent and fraud is suspected, contact your financial institution immediately through a trusted channel, notify your internal response contact and preserve the messages and payment records. Report the incident to local police and the Canadian Anti-Fraud Centre. Prompt reporting can help the response, but recovery of funds is not guaranteed.
Help your team check before paying
Review invoice-handling procedures and staff training with us. We will look at how payment changes are verified and where the process needs support.