A customer tells your collector that a large invoice has been paid. Your bank shows no receipt. The customer then forwards an email announcing your company’s “new” bank account. Nobody in treasury authorized that change.
For a B2B credit team, this situation requires more than another payment reminder. It calls for prompt coordination among the customer, treasury, information security, and management. The same coordination should exist before an incident, when legitimate changes to payment instructions are planned.
This article focuses on protecting incoming commercial payments. The practical goal is to make your legitimate instructions verifiable and give collectors a clear response when the instructions a customer received do not match your records.
Recognize the difference between correspondence and authority
Business email compromise can involve impersonation or access to genuine business communications. The FBI’s business email compromise guidance explains how criminals use lookalike addresses and compromised information to make requests appear credible.
For collectors, the important distinction is simple: a familiar-looking email is evidence to investigate, not sufficient authorization for a payment change. Correct invoice numbers, customer names, or an existing conversation thread do not establish that new bank details are legitimate.
Teach the team to flag changes to beneficiary names, account details, payment portals, or verification contacts. An urgent request to bypass the normal process also deserves scrutiny. These signals justify verification; they do not establish that a particular customer or employee acted dishonestly.
Give payment instructions a controlled owner
Designate treasury or another authorized finance function as the owner of your company’s approved receiving instructions. Collectors should have a clear way to obtain the current version without reconstructing it from old email attachments.
For each receiving entity and currency, maintain an approved instruction record with an effective date, responsible owner, and controlled distribution method. Where different divisions use different accounts, make the applicable legal entity explicit.
Before a planned change, identify the places that must be updated: invoice templates, statements, customer portals, collection templates, and customer vendor records. Retiring an old template matters as much as issuing a new one. Assign someone to check that the customer-facing versions agree.
These are recommended operating practices, not a claim that a particular credit system manages banking instructions automatically.
Build independent verification into the customer handoff
The FBI recommends verifying payment changes and obtaining contact information independently rather than using details supplied in a suspicious message. Translate that principle into a documented process your customers can follow.
During routine onboarding, establish how the customer’s accounts payable team can reach your authorized finance contact through a trusted channel. When a genuine change is needed, support the customer’s verification procedure. Do not ask them to waive it because an invoice is overdue.
A useful notice can explain the change and its effective date while asking the customer to verify through its previously established contact route. Avoid making a new telephone number in that same notice the sole means of confirming the change.
Record when verification occurred, who participated, and which approved instruction version was confirmed. Keep sensitive banking documents in the appropriate restricted location; the general collection note can reference the verification record.
A hypothetical collector response
Assume a manufacturer is awaiting a USD 48,000 payment from a commercial customer. The customer says payment will be sent that afternoon using new instructions received by email. The collector cannot find an authorized change in the finance record.
| Stage | Collector’s action | Responsible partner |
|---|---|---|
| Payment not yet sent | Ask the customer to pause use of the changed instructions pending verification | Customer accounts payable |
| Internal check | Confirm whether an authorized change exists | Treasury or designated finance owner |
| Instruction mismatch | Escalate the suspicious correspondence through the incident process | Information security and management |
| Verified next step | Document the result and agree on payment follow-up | Authorized customer and finance contacts |
This example is fictional. It illustrates a decision sequence, not a guaranteed fraud-prevention outcome. The collector does not authenticate bank details personally or forward the questionable attachment as an approved replacement. The collector connects the right owners and records what remains unresolved.
If the customer has already sent the money
Move quickly from routine collections to the incident response process. Nacha’s Business Email Compromise Response Action Plan specifically addresses customers or trading partners who sent money to a fraudulent account instead of paying you: ask the sender to contact its financial institution immediately to pursue recovery.
Notify your own treasury and security teams promptly. Preserve the suspicious messages, attachments, payment references, and relevant account history using your incident-handling process. Coordinate reporting to law enforcement, including the FBI’s Internet Crime Complaint Center, with the responsible internal team.
Do not promise that the transfer can be recalled. Recovery depends on circumstances and the institutions involved. Avoid having multiple employees independently contact the customer with conflicting instructions; assign an incident communication owner.
Keep the accounting and commercial decisions separate from the immediate response. A customer’s statement that it sent money elsewhere does not establish receipt by your company. Finance should determine the accounting treatment, and management and counsel should evaluate any contractual or liability questions. Collectors should not promise a write-off or demand duplicate payment before the authorized response is agreed.
Make the account record useful during the investigation
Create a factual chronology: when the customer received the changed instructions, when payment was reportedly initiated, when your team learned of the issue, and which parties were notified. Distinguish reported events from independently confirmed facts.
Reference the incident record from the credit account without exposing unnecessary security details to every user. Assign a date for the next customer update and identify who may approve changes to the collection plan.
If routine reminders are paused for the affected invoice, give that pause an owner and review date. Keep other valid invoices visible. A fraud investigation should not turn the entire account into an unexplained collection exception.
Rehearse the handoff before it is urgent
Use a short tabletop exercise with credit, treasury, security, and customer service. Walk through both an intercepted change request and a payment already sent. Ask the team to locate the correct contacts without relying on the suspicious email.
- Can collectors locate the approved receiving-instruction owner?
- Can customers verify changes through an established contact route?
- Are outdated templates removed from routine use?
- Does everyone know the immediate escalation path?
- Is one person accountable for customer updates and collection follow-up?
CMS Credit Suite supports recording collection outcomes, setting follow-up dates, and escalating accounts. Those capabilities can support an organized handoff; they should not be confused with bank-account verification or fraud detection. Contact Credit & Management Systems, Inc. to discuss keeping B2B collection actions coordinated with the verified information and responsibilities in your process.