Pull the last request your business received to change a vendor’s bank details. Could someone who did not handle it explain how the request was verified, where the contact number came from and who approved the update?

A clear answer should be available before the person who handled the request leaves for the day.

Consider a hypothetical business whose regular bookkeeper is away. A colleague receives payment instructions, updates the vendor record and releases the payment after a manager approves the invoice. Both people reviewed the bill. Neither independently confirmed who requested the new account.

Business email compromise can reach a business through a legitimate mailbox that a criminal has taken over. A familiar thread is useful context, but it is not independent confirmation that new instructions are authentic. The FBI’s Internet Crime Complaint Center recommends a separate verification channel for account information changes. IC3 guidance on business email compromise.

Two conversations should happen before a loss: how your team approves payment changes, and how your insurance program would treat the resulting loss.

Verify the change before changing the record

A useful procedure begins when the request arrives, rather than at the final payment approval screen. Once incorrect details enter the vendor record, later payments may look routine.

For a bank change request, consider a process with these steps:

  1. Pause the change. Keep the request separate from approved payment instructions until verification is complete. An urgent deadline should trigger escalation, not an exception that removes the check.
  2. Use an established contact. Place an outbound call to a known vendor representative through a trusted number already held in your records. Do not use a new number supplied in the same request you are trying to verify. An incoming call confirming the email is not a substitute for that outbound call. If the request changes both the bank details and the contact details, keep the change on hold until you can verify it independently.
  3. Confirm the actual change. Establish that the authorized vendor contact requested the change, which payments it affects and what details should be updated. A reply saying “yes” in the original email chain does not provide a separate verification channel.
  4. Require another person to review the result. Give that reviewer the verification record, not just the original email. Where staffing allows, separate responsibility for changing vendor data from responsibility for releasing payment.
  5. Keep a secure record. Record who requested, verified and approved the change, when those steps occurred and how the contact was established. Restrict access to banking information and supporting documents.

Travelers describes verification through a separate communication channel, including calling a known, trusted number rather than a number in the payment email. The FBI also advises verification of payment changes and consideration of two person approval. Travelers’ funds transfer guidance, FBI payment control guidance.

If an outside bookkeeper or payment platform handles bills, check the actual permissions. Who can edit the vendor record, who approves the bill and who releases the payment? Approval of an invoice is not necessarily a separate approval of changed bank details. Intuit’s QuickBooks Bill Pay documentation, for example, lists a bill payer role that can both pay bills and edit vendor details. It also explains that some plan downgrades remove approval workflows. Review your own configuration after personnel or plan changes rather than assuming the original separation still exists. Intuit’s bill payment roles and permissions.

If vendor information is imported or synchronized from another system, ask whether those changes go through the same approval process. Software may treat imported updates differently from changes made in a browser. Microsoft’s vendor bank workflow documentation illustrates why the import settings deserve their own review.

The procedure also needs a backup for absences. If the only person who can verify a change is away, employees need a clear route to an authorized substitute or a payment hold. A control that disappears during vacation is difficult to rely on. Write the procedure itself down, not just the notes from individual payments, and make sure the people handling payments can find it.

Chubb’s vendor information guide recommends documented roles, separate responsibilities, approval workflows and validation when existing vendor information changes. Use that principle to review your actual process, including changes to the contact information you rely on for verification. Chubb’s guide to managing vendor information.

If your business originates ACH payments, review the Nacha fraud monitoring requirements with your bank or payment provider. Phase 2 extended these ACH Network requirements to all remaining nonconsumer originators in June 2026. They require risk based processes and procedures appropriate to your role, with review at least annually and updates as needed. They do not prescribe one verification method or require individual screening of every ACH entry, but they do not permit dispensing with monitoring altogether. Nacha identifies vendor payment change controls as one example. Review your responsibilities rather than assuming bank monitoring replaces them. Nacha’s fraud monitoring rule and FAQs.

Identify whose money moved and how

“Wire fraud” can describe several different events in everyday conversation. An insurance policy may give those events different names, requirements and limits.

Start with the sequence of events rather than the label on a policy summary.

Your employee was deceived into sending your business’s money. Ask about social engineering, fraudulent instruction or fraudulent impersonation coverage. Check that the definition fits the person impersonated and the person who acted on the request. Chubb, for example, describes social engineering protection available by endorsement to its crime policy, including vendor, executive and client impersonation. That is an example of available coverage, not confirmation that your policy includes it. Chubb’s social engineering coverage overview.

A criminal sent instructions directly to your bank. Some forms distinguish this from an employee being tricked into authorizing a payment. Chubb’s cyber product overview separately describes computer fraud, funds transfer fraud and social engineering fraud. The distinctions are a reason to ask which insuring agreement fits your payment process, rather than assuming the words “funds transfer fraud” cover every fraudulent transfer. Chubb’s cyber coverage overview.

Your customer paid a criminal instead of paying you. The loss may concern an unpaid receivable rather than money taken from your account. Ask about invoice manipulation or comparable protection, its trigger and how the loss is measured. Coalition’s U.S. coverage description, for example, distinguishes invoice manipulation from funds transfer fraud and describes direct net costs excluding profit. Do not assume the entire face value of an unpaid invoice is insured. Coalition’s coverage descriptions.

The incident also exposed information or compromised a mailbox. Investigation, legal advice, notification and third party claims raise additional coverage questions. They are separate from reimbursement of the payment itself. The FTC recommends discussing both first party and third party cyber coverage with your insurance agent. FTC cyber insurance guidance.

These scenarios help organize a review. They do not determine coverage or decide who legally owes whom after a disputed payment.

Review the fraud terms, not just the headline limit

A declarations page showing a substantial cyber limit does not answer every fraud question. The NAIC’s 2026 cyber insurance report page specifically notes that social engineering and funds transfer fraud may be excluded, subject to a sublimit or addressed through a separate crime policy. NAIC’s 2026 cyber insurance guidance.

Ask your broker to walk through a realistic vendor payment example using the actual forms, declarations and endorsements.

Start with the people and the instruction. Who must be impersonated, and who must receive or act on the request? Does the provision require a security breach, a preexisting vendor relationship or particular verification steps? Ask which exclusions and exceptions could change the answer for that sequence of events. If an outside bookkeeper maintains the vendor records or releases payments, describe that arrangement specifically. Do not assume that someone who performs work for the business meets the policy’s definition of an employee or insured person.

Then follow the money. Which agreement is purchased, what limit or sublimit applies, and how much does the business retain? Ask how related payments are grouped and whether another loss could reduce the amount available. If both crime and cyber policies might respond, have the reviewer explain their other insurance provisions rather than assuming the limits simply add together.

Finish with the claim procedure. Find the notice address, reporting provisions, proof of loss requirements and any insurer consent or approved provider terms. Keep those instructions where the people handling payments can find them.

The CyberRisk specimen linked from Travelers’ public forms page illustrates these distinctions. Its June 2020 revision separates funds transfer fraud from social engineering fraud, uses specific definitions of the people involved and applies the agreements selected in the declarations. It also has its own limits, retentions and reporting terms. This is a publicly posted specimen, not confirmation of any reader’s issued coverage. Travelers CyberRisk specimen, pages 1, 2, 5, 6, 7, 11, 15 and 18.

Review the application as well as the policy. Travelers’ publicly posted social engineering supplement asks about verification of vendor bank and contact changes, staff training and dual authorization. Those questions show why the application should accurately describe what the team actually does. They do not establish a universal callback condition across policies. Travelers social engineering supplement, January 2019 edition.

Treat any required verification procedure as an operating instruction that the people handling payments need to understand. At the same time, do not assume every policy uses the same callback requirement or that a missed step automatically resolves a claim. The exact wording and facts need review.

If money has already been sent, act promptly

A suspected diverted payment needs immediate attention. Do not wait for the next account reconciliation or for someone to decide which insurance label applies.

Contact the originating financial institution. Use a trusted number and tell its fraud team what happened. Ask which recovery options are available for that payment and what documentation the bank needs. IC3 recommends acting as soon as fraud is recognized. A recall request is a recovery attempt, not a guarantee that the money will be returned. IC3’s BEC response steps.

For an ACH payment, do not assume that discovering fraud makes the transfer eligible for a routine reversal. Nacha distinguishes a sender’s payment error from money intentionally sent to an account later discovered to belong to a fraudster. Ask your bank about the appropriate return or recovery process. Nacha’s guidance on ACH reversals.

Report the incident through the appropriate insurance channels. Follow the notice instructions in potentially relevant policies and involve your broker. If your usual contact is unavailable, use the policy’s designated claims reporting channel rather than waiting for that person to return. Identify the transfer date, amount, discovery time and the facts known so far. Check any required insurer consent and approved provider requirements before incurring response costs, without delaying the bank call or necessary emergency containment.

Preserve the evidence. Keep the original correspondence, invoice, transfer confirmation, change request and verification records. Ask qualified IT or incident response professionals to help preserve relevant email and system evidence while addressing any compromise. The FBI advises saving incident messages and evidence; the FTC cautions against destroying forensic evidence during remediation. FBI incident guidance, FTC breach response guide.

File a detailed IC3 complaint. Use the official site and provide the relevant transaction information through its reporting process. Coordinate other required reports with appropriate professionals. Filing a complaint does not establish insurance coverage or guarantee recovery. IC3 reporting guidance. Be cautious about anyone offering paid recovery services while claiming to represent IC3. Its July 2026 alert warns about impersonators targeting people who have already lost money. Go directly to the official government site. FBI warning about IC3 impersonation.

Check for a wider incident. A forged message does not by itself prove that your systems were breached. A compromised mailbox, however, may create risks beyond the single payment. Have qualified professionals determine the scope, contain the incident and advise on any applicable notification obligations.

Even if a payment is stopped, a compromised account may still need insurance and legal review. Florida’s data breach law addresses certain unauthorized access to personal information, not simply money lost. Ask qualified advisers which notification rules apply and follow the policy’s separate notice instructions. Florida data breach statute.

If the vendor or customer disputes who should absorb the loss, involve your insurer and legal adviser before making reimbursement commitments or signing a release. A genuine invoice and a fraudulent payment destination do not, by themselves, settle that dispute.

Put the payment process and insurance review together

Bring a simple description of your payment workflow to your next insurance discussion: who maintains vendor records, who approves changes, who releases funds, how verification is documented and who covers absences. Include whether an outside bookkeeper handles any of those steps or whether your business holds money for others.

Then ask your broker to connect that workflow to the relevant coverage wording. The goal is a usable process for your staff and a clear understanding of the protection you purchased.

For broader background, see RAM’s cyber insurance review. To discuss the fraud provisions in your commercial insurance program, contact RAM Risk Group.

This article provides general information, not legal, cybersecurity, financial or individualized insurance advice. Coverage depends on the policy as issued, endorsements, facts and applicable law. Product examples are illustrative, not recommendations or promises of coverage. Consult qualified professionals about your business’s procedures and specific circumstances.

Policy wording governs.