A letter about changing details requires separate verification
The request looks like a continuation of regular correspondence: a familiar name, a shipment number, and a request to transfer money to a different account.
The external persuasiveness of the letter does not confirm the sender’s authority or the account’s ownership.
The FBI IC3 recommendations on Business Email Compromise specifically highlight the need for independent verification of changes to payment instructions.
For an international transaction, a company needs an agreed procedure before making a payment—not just careful reading of the letter.
Let’s discuss control of terms and settlements in your company
I’ll help you analyse your situation: a letter with new details is often perceived as a routine clarification in correspondence.
We’ll discuss how to address this and related foreign trade tasks in your company, the distribution of responsibilities, and next steps.
The scope of support will be agreed upon before work begins.
Confirm the change via a known independent channel
Do not use only the phone, link, or contact from the letter with the change to verify it.
Contact a previously known authorized representative via a channel that has already been independently confirmed.
Check the sender’s exact address and the content of the request, but do not consider these signs sufficient on their own.
Separate the receipt of the request, independent confirmation, internal authorization for the change, and the execution of the payment.
If in doubt, suspend the use of new instructions and refer the matter to the designated responsible person according to internal procedures.
Do not agree to skip verification just because of urgency.
Log of payment instruction changes
The training structure does not contain actual accounts or personal contacts.
| Control | What to keep | Who is responsible |
|---|---|---|
| Request | Original message and circumstances | Recipient of the request |
| Independent channel | Previously confirmed contact | Designated verifier |
| Confirmation | What exactly was verified and by whom | Verifier |
| Authorization | Decision of the authorized person | Responsible for internal procedures |
| Current version | Which instructions are authorized for use | Finance |
Illustrative scenario: the letter writer offers a new phone number ‘for verification’.
Such a number is not independent confirmation.
The verifier uses a known channel and separately clarifies the authority.
If the payment has already been sent and there is a suspicion
Immediately contact your bank via an official channel, report the circumstances, and clarify the available actions.
The possibility of stopping or refunding the transfer is not guaranteed.
Keep messages, versions of instructions, and evidence of actions.
Further response depends on the jurisdiction and circumstances; American reporting channels from IC3 materials are not a universal procedure for a Russian company.
Suspicion and proven fraud are also different—keep this distinction in work records.
Establish a procedure before the next request
Determine who verifies the change, who has the authority to approve it, and where the current version is stored.
If possible, avoid a situation where one employee changes instructions and executes a payment without additional control.
In the export transaction card, store the verification status and a link to the secure basis, limiting access to payment data.
Process readiness is tested with a training request without actual money transfer.
A practical management guide.
All examples are illustrative.
Check applicable requirements and terms for the specific product, country and contract.
Sources checked on 24 October 2026.
