FBI 2025 IC3 Report Reminder on BEC: How Cross-Border Sellers Can Verify Supplier Bank-Change Emails in 2026

Symptom: A supplier email asks us to change the bank account for an invoice or future payments.

Fastest safe response: pause payment, contact the supplier through details already saved in verified records, and require a second authorized person to review the change before funds move.

This process is for cross-border sellers handling supplier invoices and account-change notices by email, small-business owners who also approve payments, and operations or procurement staff who need a clear escalation route. It does not replace advice from a bank, lawyer, or platform.

Last updated October 20, 2026. We checked the guidance against the FBI’s BEC overview and the 2025 IC3 annual report.

What the FBI 2025 IC3 report on BEC means for cross-border sellers

The IC3 report is an official record of complaints reported to the Internet Crime Complaint Center. It is useful for understanding reported cybercrime patterns, but it does not tell us whether a particular supplier email is genuine, nor does it establish the risk level for a particular seller, industry, or platform. We therefore use the report as a reason to maintain a verification process, not as a forecast about any specific transaction.

The FBI describes business email compromise, or BEC, as a scheme that can use impersonation or a compromised email account to prompt a person or business to send money or sensitive information. A supplier-payment change fits the practical risk: a message can appear to come from a familiar business contact while directing payment somewhere new. The FBI’s BEC guidance specifically identifies fake supplier requests and payment changes as risks.

For a cross-border seller, an overseas time zone, an invoice deadline, or a normal supplier relationship can make a message feel routine. None of those details proves who sent it. A familiar signature is not independent verification. Neither is a reply within the same email thread, because the person replying may not be the authorized contact—or the account itself may be under someone else’s control.

The FBI has also warned that BEC messages can imitate legitimate business correspondence. Small differences in an email address can be easy to miss when a team is processing invoices quickly. See the FBI’s explanation of BEC and email impersonation. That is why the key question is not only “Does this look like the supplier?” It is “Can we confirm the change through a channel that did not come from this request?”

A mailbox can organize a message; it cannot authenticate the sender.

Before a request: prepare independent supplier records

A reliable check starts before anyone receives a payment-change email. If the only phone number on file is copied from a new message, the team has no independent route to the supplier. Set up and maintain verification details using a contract, purchasing file, established business relationship, or another record already checked by your team.

Keep a supplier contact record with:

• The supplier’s legal or trading name used in your purchasing records.
• The established business contact and the person authorized to approve payment-detail changes.
• A phone number or other known contact route saved independently of invoice-change emails.
• The finance contact, if different from the day-to-day account contact.
• The date and source used to confirm those details.
• The internal role authorized to approve a change and the role authorized to release payment.

The point is not to collect contact details from every message. It is to preserve a route that remains useful if an email account, a thread, or a contact’s address is compromised. When a supplier provides a new number in the same message that requests a new account, do not treat that number as your only check. The requester controls the information in the request; verification needs a separate source.

In a small team, assign ownership even if one person performs several roles. For example, the owner can approve a change while a bookkeeper records the verification, or a procurement lead can confirm the supplier while a different person releases the payment. If one person must cover both roles, document that limitation and involve the business owner before a new payment destination is used.

This preparation also helps separate supplier correspondence from promotions and routine platform notices. Our guide to keeping a business inbox organized covers ways to make important operational messages easier to find. Organization improves retrieval; it does not prove a sender’s identity.

When the request arrives: how can you verify a supplier bank-change email?

Treat any message that changes where or how you pay as a request awaiting verification. Do not approve it by replying “confirmed,” clicking a link in the message, or using a phone number supplied only in that message. The FBI’s supplier-payment guidance recommends independently verifying changes to vendor payment procedures.

Use this sequence:

1. Pause the affected payment. Keep the existing payment instructions in place while the request is checked. If an invoice is due soon, notify the supplier through an established contact route that verification is in progress. Do not let urgency substitute for confirmation.

2. Open the supplier record from your own files. Use the contact details in a previously verified contract, procurement record, or supplier directory. Do not obtain the number by following a link, calling a number, or opening an attachment in the change request.

3. Initiate contact independently. Call the known number or use another established channel already on file. If the supplier’s usual contact is unavailable, use a different known contact, such as the finance contact. Do not simply reply to the original thread and accept a response there as independent confirmation.

4. Confirm the exact change. Ask the authorized supplier contact to state the supplier name, the old and new payment details or the relevant changed fields, and when the change should take effect. Avoid reading out sensitive details unnecessarily; the goal is to compare the request with what the authorized contact confirms.

5. Record how the check was completed. Log the date and time, the person contacted, the source of the contact details, the exact change confirmed, the employee who performed the check, and the result. If the supplier disputes the request, preserve the message and escalate it rather than deleting it.

6. Escalate uncertainty. If the established contact cannot be reached, the new details differ from what was confirmed, or the supplier contact disputes the change, keep the hold in place. Ask a manager or owner to decide the next step. Do not resolve a discrepancy by choosing whichever message looks more convincing.

The IC3’s recommendations for payment-change requests support a key distinction: use contact information obtained independently from the change request. That is different from checking whether the message appears to come from the supplier. A familiar display name, an existing thread, or a plausible invoice number can be part of the request, but none replaces an independently initiated confirmation.

Before payment: how should a small company build a second check?

Separate approval of the new payment details from execution of the payment. The person who records or verifies a change should not be the only person who authorizes the transfer. A second reviewer should compare the confirmed details with the payment being prepared, not merely approve the email as a whole.

Before releasing funds, the second reviewer should compare the supplier identity, the destination details, the effective date, the verification record, and the approval. If any of those elements conflict, stop the payment and return to the supplier through an independently sourced route.

A second approval is an internal risk-control recommendation, not a claim about what every bank, law, or platform requires. A small business can define a simple rule: no payment instruction changes until one person confirms them independently and another authorized person reviews the recorded result. Where staffing is too limited for a full separation of duties, the owner can act as the second reviewer and document the exception.

The payment review should also account for changes that are easy to overlook. A request might alter only the beneficiary name, ask for a different payment method, or apply to one invoice rather than all future payments. Confirm the scope instead of assuming that “new account” means one particular kind of change. Keep the existing supplier record intact until the change has been confirmed and approved; then update it with the verification date and approver.

Warning signs: how do you assess a possible phishing or impersonation attempt?

No single clue proves a message is fraudulent. Treat these details as reasons to verify, not as a verdict:

• A request changes a bank account, payment route, beneficiary, or payment procedure.
• The message asks for urgent action or discourages normal approval.
• The sender address differs slightly from the address in supplier records.
• The email asks the recipient to keep the change confidential or bypass another contact.
• The wording, signature, or invoice context looks familiar, but the request itself is unusual.
• A supplied phone number, link, or attachment is presented as the quickest way to confirm the change.
• The change is inconsistent with a contract, earlier invoice, or known supplier instruction.

The FBI’s BEC materials describe impersonation and compromised business accounts as ways a fraudulent request can look credible. That means a clean-looking message is not enough to pass a check, and a typo is not required for a request to deserve scrutiny. Use the same independent verification process even when the email has no obvious spelling errors or unusual tone.

If the request appears suspicious, preserve the original message and relevant headers if your email system permits it, then follow your organization’s reporting process. Do not forward sensitive payment information broadly while asking colleagues whether the email “looks real.” Share only what they need to investigate, and contact the supplier using a route already in your records. If payment has already been sent, contact your bank promptly using its established contact details and follow its instructions. This is a response step, not a guarantee that a transfer can be recovered.

Ongoing maintenance: keep supplier checks usable

Supplier verification records can become stale. People leave, phone numbers change, and purchasing relationships move between teams. Assign a named role to maintain the primary supplier contact, finance contact, and approval history. Review those records when a supplier relationship changes and as part of routine purchasing administration. If a saved number no longer works, verify a replacement through an established business channel before relying on it for a future payment change.

Use a consistent record format so an employee can see whether a change was checked without reconstructing the decision from scattered email threads. At minimum, record the request, independently sourced contact route, person reached, confirmed details, reviewer, date, and outcome. Keep the original request alongside the record where your retention practices allow. A short, complete audit trail helps the next employee understand why an instruction was accepted or rejected.

Email labels, forwarding rules, and separate inboxes can make supplier notices easier to locate. They can also help keep customer inquiries from getting buried among automated platform updates. But an email-management setup is not an identity check. A forwarded message is still the same message, and an isolated inbox does not make an unknown sender trustworthy.

For tool trials, newsletters, or other low-risk registrations, a temporary address or mail-routing layer may help keep signup traffic away from the customer-facing mailbox. That is a different use case from supplier invoices and payment instructions. Use a long-term, accessible business address for important supplier relationships and accounts that need continuity. For low-risk signups, our privacy guidance for managing email addresses can help distinguish inbox separation from authentication. A guide to choosing a disposable address can also clarify where temporary addresses may fit; they should never be used to authenticate a supplier or manage a critical payment relationship.

OnceFwd’s temporary inbox and forwarding options can support low-risk registration and inbox separation, but they cannot certify who sent a supplier message. Keep supplier verification anchored to independently saved contacts and a recorded second review. To improve the way a small team sorts operational messages and escalates important ones, use a consistent business inbox cleanup process.