Check a changed payment instruction before routine routing

Where the extra work starts

Keep the request visible and follow your approved process so a familiar email thread does not substitute for checking the change.

Once someone owns the email, the invoice PDF may still need to be keyed into Excel. Download the attachment through your approved process, then use ParseMill to extract, review and export it. Shared-inbox routing and replies remain with your existing email tools.

This guide does not authorize a payment, validate bank details or replace the firm's controls. An apparently familiar email thread is insufficient by itself to establish that a change is genuine.

A practical way to get it right

Record the request reference and the nature of the proposed change without spreading full payment details through general task notes. Preserve the original message in the approved location. Assign the verification action to the person authorized by the firm's procedure, and mark routine updating as blocked pending that decision.

Use the established independent contact route rather than contact details supplied in the change request. The verifier should follow the firm's exact process for confirming the request and the authority of the person making it. Record the outcome reference and decision maker, not passwords, security answers or unnecessary account data.

Separate verification from execution. A confirmed request may still require further approval under the firm's process. The person performing any subsequent update should check that all required approvals apply to this specific change and version of the instruction.

FBI: Business Email Compromise recommends verification through independently obtained contact details. Keep the proposed change on hold while the authorized person follows the firm’s verification procedure.

What this looks like on a real task

Synthetic example. The people, references and figures below are invented to demonstrate the method.

The table shows administrative stages, not a payment checklist. Copy the stage, reference and next-actor columns into a restricted action record. “Verification recorded” must identify an actual outcome; it is not automatically equivalent to permission to update or pay. Do not populate a training example with real account numbers.

Catch the cases that create rework

Pressure to act quickly should be recorded for the verifier, not used to bypass the hold. A phone number or link inside the suspicious message is not an independent channel. If the request fails verification or raises concern, follow the firm's incident escalation process and preserve the evidence.

If an update or transfer may already have occurred, escalate immediately through the firm's incident process and relevant financial institution. Do not attempt to resolve a potential compromise through further replies to the questionable thread.

IC3: Business Email Compromise recommends a secondary channel for account-change verification. A reply within the same questionable thread is not that independent confirmation.

Decide whether the change is worth keeping

Before the administrative action closes, confirm the request has a recorded verification outcome, any required approval and an accountable next owner. A rejected or abandoned change should have a reason and remain traceable. Review whether ordinary inbox routing could bypass these states; the useful improvement is a dependable hold and handoff, not faster processing of an unverified instruction.

The workflow audit checklist can help record the observed friction before considering a change.