The email looks ordinary. A roofing contractor you know says its bank has changed and asks you to use new instructions for the next payment. The signature is right. The message sits in an existing thread. A follow-up call even appears to come from the contractor’s number.
Pause there.
Business email compromise targets people and organizations that make legitimate transfers of money, often through social engineering or a compromised account.[1] A polished message, familiar thread, or recognizable voice does not prove that the payment instructions are genuine. NIST notes that phishing can arrive through email, text, phone, social media, or postal mail.[3]
A small property management firm can reduce the guesswork with a simple rule: nobody changes a vendor’s payment destination using contact information supplied in the change request. The team verifies the request through a contact path it trusted before the request arrived.
Build the verification path before a request arrives
Choose three or four vendors that receive regular or high-value payments. For each vendor, keep a controlled record with the legal business name, normal payment method, approved contact, independently established phone number, and the person inside your firm who owns the relationship. Limit access to staff who need it and give one person responsibility for reviewing the record.
Do not build this record from a bank-change email. Use an existing contract, prior validated onboarding record, or a number obtained from the vendor’s public website and separately confirmed with the known relationship owner. NIST advises verifying an urgent request with known contact information or information from a public company website, rather than using the message itself.[3]
Write the payment-change procedure in plain language. The FTC recommends clear procedures for approving purchases and invoices and close review of invoices.[2] For a small firm, the procedure can fit on one page:
- Hold the proposed change.
- Open the vendor record without using links, phone numbers, QR codes, or attachments from the request.
- Call the approved vendor contact at the number already on record.
- Ask the contact to confirm the request and the last four digits of the new account through your agreed process. Do not read the proposed details first.
- Have a second authorized employee review the supporting record and approve the change.
- Record who verified it, which trusted channel was used, who approved it, and when the change takes effect.
The second review should be meaningful. If one employee prepares the change, that same employee should not provide the only approval. When staffing is thin, name an owner or outside bookkeeping contact who can perform the second check without sharing full banking details in ordinary email.
Run a 20-minute drill
Give the team a fictional email from a familiar plumbing company. It says an invoice is overdue, includes new ACH instructions, and asks for payment today to avoid delaying work at a building. Add a fictional reply in the same email thread from someone who appears to be the vendor’s usual contact.
Do not use real account numbers, real invoices, actual tenant information, or a live vendor mailbox. The exercise should test decisions, not people, and it should never put real funds at risk.
Ask the employee who normally handles invoices to talk through the first five minutes. Watch for four actions:
- the payment change is placed on hold;
- no one replies to the message or uses its contact details to verify it;
- the employee opens the trusted vendor record through the normal system;
- the request goes to the right internal approver.
Then add a phone call. The caller sounds familiar and caller ID shows the vendor’s name. The FTC warns that scammers can fake phone numbers, so caller ID should not be treated as verification.[2] The correct move is to end the incoming call and place a new call using the number in the trusted vendor record.
Make the pressure realistic but not theatrical. The caller can mention an overdue invoice or a delayed service visit. The FTC says scammers often create urgency so a target acts before checking the claim.[2] The drill should make a calm delay normal: “We verify every bank-detail change. I will call our approved contact using the number on file.”
The employee should not have to accuse anyone of fraud. The same neutral process applies when the request is legitimate. A consistent rule also makes it easier to resist exceptions requested by an executive, a rushed property manager, or a long-time vendor.
Decide what counts as a completed check
A callback by itself is not enough if the number came from the suspicious message. An email reply is not enough if the mailbox may be compromised. A screenshot of a voided check is not enough if it arrived with the request.
For the drill, require a short verification record that answers:
- Which pre-existing source supplied the callback number?
- Who at the vendor confirmed the change?
- What information did the vendor provide without being prompted?
- Who inside the firm approved the update?
- When does the new payment method begin?
- Was a small test payment required under the firm’s policy, and who confirmed receipt through the trusted channel?
The FBI recommends a secondary channel or two-factor authentication when verifying a request to change account information.[1] That does not mean sending a code to a phone number listed in the same suspicious email. The second channel must be independent of the request.
Finish the drill by checking the accounting or property-management platform. Can one user change vendor banking details and release payment without review? Does the system retain an audit trail of the old value, new value, editor, approver, and time? If the software cannot enforce separate approval, document the compensating review and test it with the people who will actually use it.
Rehearse the bad outcome too
Now change the scenario: the payment was sent yesterday, and the real vendor says it never arrived.
The first call goes to the firm’s financial institution. The FBI advises businesses that discover a fraudulent transfer to contact their financial institution immediately, request a recall, and file a complaint with IC3 as soon as possible.[1] NIST likewise advises contacting the bank immediately when phishing compromises a company financial account and following the company’s incident-response plan.[3]
Give the team a short response card with the bank’s known fraud number, the account owner, internal incident lead, legal or insurance contact where applicable, and the information needed to identify the transaction. Keep reporting obligations and decisions with the firm’s authorized legal, compliance, insurance, and banking contacts. The drill is meant to expose missing contacts and unclear authority, not provide legal advice.
Also decide who preserves the email, headers, call details, payment record, approval trail, and relevant account logs. Avoid deleting the message or continuing a confrontation with the sender. If credentials may have been entered or an account may be compromised, use the firm’s incident procedure to contain access, reset affected credentials from a trusted device, review account activity, and notify the right internal and external parties.
End with two fixes, not a long wish list. One might be completing trusted vendor records for the ten vendors paid most often. Another might be requiring a second approver for every bank-detail change. Assign an owner and a due date, then run the drill again with a different employee.
For practical guidance on cyber risk and safer technology use, subscribe to Cyber & AI Insights.
If your property management team wants an independent review of its payment-change and impersonation response workflow, schedule a conversation with Your Data Guardian.