Supplier / payee:
Invoice / amount / currency:
Person handling the request:
Decision owner:
Pause
- Do not change bank details or send a transfer based only on an email, chat, invoice, or incoming call.
- Mark the payment “verification in progress”; do not silently reject it or blame the person who raised it.
- Preserve the message and attachment in their original form. Do not forward them beyond the people who need to check them.
Confirm through a known channel
- Find a number in the contract, supplier record, or earlier verified data.
- Do not use a number from the change request, new invoice, or email signature.
- Place the call yourself. Ask a known contact about the bank-detail change, amount, and person authorised to confirm it.
- If the caller rings back or the voice sounds familiar, still make your own call to the known number.
Known number — source (do not enter the full number if this card will circulate):
Date, time, and timezone:
Person reached:
Outcome: confirmed / not confirmed / no contact
Two people
- Person 1 verified the change through a known channel.
- Person 2 compared the details and approved or stopped the change.
- Neither person approves their own request for an exception.
Person 1 / time:
Person 2 / time:
Escalate when
- the supplier refuses a call or asks you to use only the new channel;
- there is pressure, secrecy, or an instruction to bypass the second person;
- the account, payee name, country, currency, or conversation is inconsistent;
- the payment has already left — do not wait for certainty; contact the bank through its official channel and the decision owner.
Escalated to / time:
Decision and short reason:
This card supports a process; it does not prove that a document is authentic or that someone is entitled to the funds. An invoice and the CEO’s voice in the AI era explains the attack context, while a security assessment can examine roles and exceptions.