Stop a BEC payment-change request

Practice the FBI / CISA BEC order from AP-security training. Bank details from email are not entered until an out-of-band callback to a known number succeeds.

1. Treat any emailed bank-detail change as fraud until proven otherwise.
2. Do not use phone numbers or links from that email.
3. Call the vendor on a number already in the master file.
4. Confirm the request with a named person who has authority.
5. If confirmed, update the record through dual control.
6. If not confirmed, freeze the payment.
7. Notify the bank and FBI IC3 as appropriate.