A repeatable pause-and-verify routine for unexpected invoices and payment-detail changes, with a trusted callback path and a named person to escalate to.
- Pause
- Verify
- Record
1. Pause the action, not the whole business
An invoice arrives during a busy afternoon. It looks familiar, but asks you to use new payment details, open an attachment, or call a number to cancel an unexpected charge. The useful first question is not whether the logo looks convincing. It is whether the requested action has been independently verified.
This remains a practical business IT concern in late 2026. The FTC's May 2026 small-business invoice alert describes fake invoices, including messages designed to obtain access to business data and networks. That is a reason to review your routine, not evidence that every unfamiliar invoice is fraudulent or that attacks have increased by a particular amount.
For this check, hold the requested payment, account change, login, or attachment opening until the responsible person verifies it. Do not use a link in the message to inspect your account. Go through a saved, trusted route instead. The FTC's phishing guidance recommends contacting the organization through a phone number or website you already know is genuine.
2. Verify through a separate, trusted path
Find the vendor contact in your existing approved records, an established contract, or a previously verified account portal. Do not treat a new number in the email signature as independent confirmation. If you cannot identify a trusted route, ask your usual account contact or manager to establish one before proceeding.
Ask the known contact to confirm the specific request: invoice reference, underlying work or order, amount, and whether a payment-detail change was actually authorized. Do not supply passwords, verification codes, or remote access as part of this check. A confirmation should resolve the request, not introduce another urgent instruction from an unverified caller.
If the message names an internal approver, confirm with that person through your normal internal channel. Avoid replying to the suspicious thread and assuming that proves who is on the other end. The FTC's small-business cybersecurity guidance similarly recommends using a known number when checking a vendor, client, or colleague's request.
Example to adapt: An established supplier requests new bank details. The coordinator marks the request "verification pending," calls the supplier using the existing vendor record, and records who confirmed it and when. The designated approver reviews that evidence before any change. If confirmation is unavailable, the change remains on hold.
3. Make the check easy to follow
Decide who can approve a new vendor or a payment-detail change and who provides cover when that person is away. Where staffing permits, separate verification from approval. For a one-person business, use the same documented callback rule and pause rather than inventing a second approver you do not have.
Keep a short record: request reference, trusted contact route, person reached, confirmation time, approver, and outcome. Record the verification without copying full bank details or unnecessary personal information into a general team chat. Protect the vendor directory too; an editable list with no owner is a weak foundation for checking future changes.
Rehearse with a fictional invoice and a fictional change request. Can a teammate find the approved contact and escalation owner without asking the sender? Make reporting a suspicious message straightforward and blame-free. This routine supplements technical controls; it is not a substitute for account protection.
Ask your IT administrator about stronger sign-in options for email and administrative accounts. CISA's phishing-resistant MFA fact sheet distinguishes stronger, phishing-resistant authentication from other forms of multifactor authentication. Available options depend on your service and configuration, and sign-in protection does not itself validate an invoice.
4. If someone already acted, escalate promptly
Tell the designated internal contact what happened: opened attachment, submitted password, approved login, changed details, or sent payment. Keep the original message available for the people handling the incident, and use your established reporting path. Do not ask the suspected sender for recovery instructions.
If money was sent, contact your bank or payment provider immediately through an independently verified number and ask about its fraud process. Recovery is not guaranteed. If credentials or a device may be affected, involve your IT administrator or service provider promptly; account and device recovery depend on the system involved. The FTC's guidance on what to do after a scam gives next steps by payment method and type of exposure.
The verification checklist
- The requested action is paused until verification.
- The contact route came from a trusted, separate record.
- The exact request and authorization were confirmed.
- A named approver and backup know the outcome.
- Any action already taken has been escalated promptly.
Limits of this check
No callback routine catches every scam. Trusted records can be wrong, accounts can be compromised, and an invoice can be disputed without being phishing. This guide is an operational starting point, not incident-response coverage, a security audit, or a guarantee against loss. Mission Desk's practical IT guidance does not imply continuous monitoring or a 24/7 response service.
Primary sources
Reviewed November 3, 2026. The verification example and checklist are Mission Desk's practical adaptation of the linked guidance.