Construction payment bank-detail changes: verify the request before updating the payee

A convincing payment email can still contain false instructions

A Houston construction-office employee receives a reply in a familiar billing thread. It includes the right project name, the open invoice amount and a request to replace the bank details before the next payment run. The sender says the old account is being audited and asks the office to act quickly.

The details make the request look plausible, but plausibility is not verification. The FBI’s Internet Crime Complaint Center describes business email compromise as a scheme that can lead to unauthorized fund transfers. Its prevention guidance recommends verifying account-information changes through another channel.

This checklist applies to an office paying vendors and to a subcontractor whose customer receives a purported change to the subcontractor’s own details. Agree on a verification process before a change occurs. The payment-onboarding guide helps establish the known contacts that process needs.

Create a pending-change record before touching the vendor master

Separate the request from the approved vendor record. Capture the received date, purported sender, affected payee, invoice or project reference and employee handling the check. Keep the existing payment destination unchanged until the verification and required authorization steps are complete.

Urgency, a changed reply address or a request to bypass the usual approver should trigger closer review. Those indicators are reasons to investigate, not proof of fraud by themselves. A legitimate business can change banks; the point is to confirm who authorized the change.

Do not rely on a bank-letter attachment as the only confirmation. It can be part of the evidence packet, but the office still needs independent contact and approval. Avoid circulating full account numbers in a broad task log.

Use a known contact route for the verification call

Call an authorized contact using a number already established in the approved vendor record or an independently verified business source. Do not use the callback number supplied in the change-request email as the sole verification route. The FBI’s published guidance specifically advises previously known numbers for this type of phone check.

Ask whether the business requested the change, who is authorized to approve it and which secure channel should carry the details. Confirm the information using your organization’s agreed procedure. A caller should not collect passwords, one-time login codes or unrelated personal information.

If the known contact cannot be reached, leave the request pending and escalate internally. A deadline for the payment run is not a reason to quietly mark a failed callback successful. Record the operational consequence so an authorized person can decide the next step.

Document the check and obtain a separate authorized approval

Where the business uses separate preparation and approval roles, the second person should review the callback evidence before approving the vendor change. Smaller offices need a workable process that still avoids letting the same unverified message serve as request, evidence and approval.

Use a change register that shows what was checked without exposing the full banking data. The secure vendor system can retain the underlying details with appropriate access controls. The task record should identify the approver and the exact version activated.

Worked example: the invoice is valid but the change is not confirmed

Original fictional example: an $8,400 invoice is genuine and already approved. A new message requests payment to a different account. During a callback using the existing vendor contact, the business says it has not requested a change. The office preserves the message and escalates the suspected incident instead of replacing the payment details.

The approved invoice and the questionable bank-change request stay as separate records. The fraud concern does not automatically erase the payable, settle the invoice or authorize a different payment route. The responsible staff determine how to make payment safely under the business’s procedures.

After any payment, reconcile the actual receipt or remittance against the invoice. A changed vendor record or a screenshot saying “submitted” is not proof that the intended recipient received the funds.

If funds may have been misdirected, act promptly

Contact the originating financial institution immediately when a fraudulent transfer is suspected. IC3 guidance also directs victims to file a detailed complaint. Preserve the original communications and transaction information for the bank and investigators; follow their instructions for providing sensitive details.

Do not promise recovery or assume a recall will succeed. Avoid waiting for the normal weekly collections meeting when funds may already be moving. Coordinate the response with the organization’s security, finance and authorized management contacts.

The payment follow-up log can record the next responsible action, but it should not become a widely shared incident file containing complete account details.

Verification questions to settle before the next payment run

Does a familiar email address prove the request is genuine? No. An account can be compromised, and a similar address can be mistaken for the real one.

Does an MFA-enabled email account remove the need for the check? Keep account protection and payment-change verification as separate controls. One should not silently replace the other.

Can the office validate bank ownership inside Texas Notice Tracker? No. The workspace organizes payment records; it is not a banking-verification or fraud-recovery service.

What is the best time to agree on the callback process? During onboarding, while both parties have time to establish authorized contacts and an approved secure exchange method.