Verify a changed invoice before paying

The short answer: Business email compromise often preserves the real conversation and changes only the payment instructions. Visual consistency therefore provides weak assurance.

A familiar invoice can contain a fraudulent change

The useful move is to separate what the claimant controls from evidence you can obtain independently. Names, logos, caller ID, screenshots and a polished page can all be copied. A saved telephone number, a typed official address, a known colleague or a protected transaction route changes the channel instead of merely inspecting the same claim again.

Risk also depends on consequence. Reading a public page is different from granting remote access, sending an identity document or approving an irreversible payment. As the cost of error rises, require stronger verification and prefer a step you can undo.

Before replying or approving a request, the email authenticity checklist can organise sender, context and consequence checks.

Warning signals to assess together

These clues become useful when they form a pattern. Treat each one as a prompt to verify, not as a verdict by itself.

• Bank details change near a payment deadline

  Pair this observation with a separate check: Call a previously known contact.

• The sender discourages telephone confirmation

  Pair this observation with a separate check: Use a documented change-of-bank-details process.

• A reply-to address or account name differs subtly

  Pair this observation with a separate check: Confirm the beneficiary name and preserve the email headers.

Do not use one clue as a verdict: A familiar email thread proves context, not control of the mailbox. Payment changes deserve out-of-band verification.

Compare this with the vendor bank-detail verification guide, where identity, payment protection and recourse must be assessed separately.

Verify an invoice change before payment

Keep the verification route separate from any contact detail or instruction supplied in the questionable message.

• Call a previously known contact

  This step tests the related concern: Bank details change near a payment deadline.

• Use a documented change-of-bank-details process

  This step tests the related concern: The sender discourages telephone confirmation.

• Confirm the beneficiary name and preserve the email headers

  This step tests the related concern: A reply-to address or account name differs subtly.

Decide what to do after verification

If the independent channel confirms the identity and request, ask whether the proposed method still gives you a record and recourse. Legitimate people and organisations should tolerate a proportionate verification step. Resistance, secrecy or a demand to bypass normal controls is new evidence, not an inconvenience to ignore.

If the evidence remains mixed, reduce exposure: do not send original documents when a redacted copy is enough, do not pay a deposit before verifying authority, and do not approve access broader than the task requires. “Not yet” is a valid decision when the missing fact matters.

What this verification cannot establish

This guide cannot authenticate a specific person, account, website or transaction. Interfaces and attack methods change, and legitimate situations sometimes contain unusual details. For an active loss, account compromise or safety threat, contact the relevant institution or official reporting service through a verified route.