Before You Pay: Verify Invoice and Bank-Detail Changes

A fake invoice does not always look suspicious.

It may arrive from a familiar-looking email address. It may mention a real supplier, a real project, or a service your company actually uses. It may even look like a normal request from someone inside the business: “Please process this today.”

That is why invoice and payment-change scams work. They are designed to feel routine.

For small and medium-sized businesses in Trinidad and Tobago, this is an everyday risk. Accounts staff, managers, office administrators, and business owners all handle payment requests under time pressure. A scammer only needs one rushed approval to redirect money to the wrong account.

The safest habit is simple: slow down and verify payment details before money moves.

The warning signs to watch for

Be extra careful when a message asks you to:

• pay an invoice you were not expecting
• update a supplier's bank account information
• send money urgently or outside the normal approval process
• keep the request confidential
• click a link to view or approve an invoice
• open an attachment from an unexpected sender
• confirm passwords, banking details, or company information
• reply only by email, WhatsApp, or text instead of using your usual contact method

None of these signs proves the request is fake on its own. But they are enough reason to pause.

Scammers often impersonate people or companies you already trust. They may copy logos, email signatures, invoice layouts, and names from public information. They may also use pressure: “the payment is overdue,” “the account will be suspended,” or “the supplier is waiting now.”

The pressure is part of the scam.

What to do before approving payment

Build a short verification step into your payment process, especially for new vendors, changed bank details, urgent invoices, or large payments.

Good habits include:

• Call the supplier using a phone number already saved in your records, not the number in the new email.
• Confirm bank-account changes with a known contact before updating payment details.
• Require a second person to approve new payees or changed banking information.
• Compare the invoice against purchase orders, contracts, delivery notes, or prior invoices.
• Check the sender's full email address carefully, not just the display name.
• Use your accounting system or vendor portal directly instead of clicking invoice links in email.
• Keep a written note of who verified the payment change and when.

This does not need to be complicated. A two-minute call can prevent a very expensive mistake.

What not to do

Avoid these shortcuts:

• Do not approve a bank-detail change based only on email.
• Do not call the phone number supplied in the suspicious message.
• Do not let urgency override your normal payment process.
• Do not forward the message around widely if it may contain a malicious attachment or link.
• Do not enter login details after clicking a payment or invoice link.
• Do not assume an email is safe because it appears to come from a known person.

If a real supplier needs payment urgently, they will understand a verification call. A legitimate request should survive basic checking.

If you are unsure

If something feels off, stop before paying.

Use a trusted contact method to verify the request. Ask your manager, accounts lead, or IT support to review the message. If your company has a ticketing or helpdesk process, submit the email there rather than handling it quietly on your own.

If you already clicked a link, opened a suspicious attachment, entered a password, or sent payment to the wrong account, report it immediately. Early reporting gives the business a better chance to contain the issue, reset credentials, contact the bank, and preserve evidence.

The goal is not to blame the person who received the message. The goal is to stop the loss and protect the business.

A simple office rule

Here is a practical rule every business can adopt:

Any new bank account, changed payment instruction, unusual invoice, or urgent payment request must be verified through a known trusted channel before payment.

That one rule can protect your company from fake invoices, supplier impersonation, and business email compromise.

Cybersecurity is not only about software. It is also about calm, consistent habits that help people make safer decisions during a busy workday.

Sources: Federal Trade Commission — Scams and Your Small Business: A Guide for Business and Cybersecurity for Small Business: Phishing; National Cyber Security Centre — Business payment fraud.