Almost every contractor has heard the advice to call the vendor before changing bank details. It is good advice, and it is also routinely done in a way that defeats the purpose. A callback is only a control if the number you dial is one the fraudster did not supply, and if the person dialing knows what to ask and what to do with the answer.
The FBI's Internet Crime Complaint Center has long warned about business email compromise, where criminals impersonate a vendor or executive and request a change in payment instructions. The common thread is urgency and a request that looks routine. Callback verification works because it moves the conversation off the channel the attacker controls.
Where Callbacks Go Wrong
Before the right method, the common failures:
- Calling the number in the email. If the message came from a spoofed or compromised account, the phone number in the signature may be the attacker's.
- Replying to the same email thread to "confirm." That is not verification; it is asking the attacker to confirm himself.
- Verifying with whoever answers. A receptionist cannot authorize a banking change, and a voicemail greeting proves nothing.
- Letting the requester pick the time or the person. Pressure to rush or to talk to a specific contact is a flag.
- Skipping the step for existing, trusted vendors, which is exactly who attackers impersonate.
The Right Way, Step by Step
1. Use a Number You Already Had
Look up the vendor in your accounting system, a prior signed contract, a previous invoice from before the request, or a lien waiver on file. Do not use the number on the new request. If no prior number exists, that is a new vendor and a different process applies.
2. Call a Known Contact
Reach a person you have dealt with, ideally someone in the vendor's accounting or ownership role. Ask them to confirm the request in their own words rather than reading you a script.
3. Ask Specific Questions
Rather than "did you send a banking change?", ask for details that require real knowledge:
- Which project and invoice does this change apply to?
- Which bank are the new instructions for, and what name is on the account?
- Why is the account changing, and does it apply to future payments too?
An imposter on a spoofed email thread usually cannot answer these, and a real vendor will not mind being asked.
4. Confirm the Details Back
Read the account details aloud, or confirm the last four digits of the new account. Do not accept a verbal confirmation without matching it to the written change.
5. Document It
Record who called, who answered, the number used, the date and time, and the outcome. Attach this to the vendor record. If something goes wrong later, that record shows a control existed and was followed, which matters with your bank, insurer and the vendor.
Add Controls Around the Callback
A callback should not be the only safeguard.
- Separate duties. The person who updates banking details should not be the person who approves the payment.
- Hold period. Consider a short delay before the first payment to changed instructions, so there is time to catch an error.
- Small test payment where appropriate and practical, followed by confirmation.
- Alerts. Flag any vendor record whose banking information changed in the past thirty days when payments are reviewed.
- Protect the mailbox. Multi-factor authentication on finance email makes account takeover far less likely.
Make It Easy to Follow
Controls fail when they are inconvenient. Put the steps on a one-page checklist beside the AP desk, build a banking-change form that requires the verification fields, and make it clear that no one will be criticized for slowing down a payment to verify it. Executives should be held to the same process; a request that claims to come from the owner is a classic pretext.
If You Suspect You Paid a Fraudster
Contact your bank immediately and ask for a wire recall or fraud hold, then report to the FBI's IC3. Speed matters, and the first hours are the best chance to recover funds.
Working With Ironfield Cyber
We help contractors and energy firms build payment verification procedures, secure finance mailboxes and train accounting staff on real scenarios. If you would like to test your current process, we can walk through a banking-change request with your team and show you where it breaks.