Verify Payment-Change Requests Before Money Moves

A familiar message thread, recognizable name, urgent deadline, or plausible explanation is not enough to approve changed payment instructions. If the request itself controls the contact path used to confirm it, the verification may simply repeat the same compromised information.

This guide creates a hold-and-verify gate for a small team. It records decisions and evidence before money moves. It does not perform a payment, investigate fraud, contact a bank, or establish legal or contractual entitlement.

Keep eleven verification concepts separate

Request intake recognizes that established instructions would change. The transaction hold prevents the changed instruction from being used prematurely. Commercial ownership identifies who owns the underlying business relationship. A trusted contact source is selected outside the request. An independent channel is chosen from that source. Identity verification and request-authority verification answer different questions. Change-detail verification compares the bounded decision without copying sensitive values. Commercial approval confirms the business decision. Payment authorization separately controls release of funds. Evidence, discrepancies, and closure show what was inspected, what remains unresolved, and why the gate stopped or closed.

Do not reduce these concepts to one verified, approved, or callback complete checkbox. A callback alone does not establish authority, commercial approval, payment authorization, evidence quality, or absence of fraud.

What the sources establish—and what they do not

FBI/IC3 advises using secondary channels to verify requests for changes in account information with the intended recipient. NIST advises verifying urgent requests with known contact information or independently obtained public company information rather than details in the message. NCSC supports verifying important email requests through a second type of communication.

Those sources support reducing reliance on the requesting channel. They do not prescribe the nine stages, mandatory hold, role model, 18 fields, approval count, evidence threshold, exception pattern, closure state, bank procedure, legal duty, or fraud conclusion below. Those are PlainFort editorial choices for a small-team operating record, not a guarantee against loss or a regulated approval model.

Define independence conservatively

Do not use a telephone number, address, link, QR code, account, portal, or contact instruction supplied by the change request. A reply in the same thread, a second message from the same mailbox, or another route controlled through the same account is not independent by default.

Select the source category from a previously approved internal record, established contract record, independently navigated official public source, or another authorized business record. Then select the communication channel from that source. Record only source and channel categories—not contact or payment data—in this artifact.

A different channel can reduce reliance on one signal. It does not prove identity, authority, absence of collusion, or resistance to synthetic voice or video. Do not call a channel secure, verified, or trusted merely because it is different.

Apply the nine-stage hold and verification gate

The sequence below is PlainFort editorial judgment. The hold remains in place until the record closes with evidence, the change is rejected, or the matter is escalated.

1. Recognize the change and place the hold

Identify only the bounded change category and a non-precise received time band. Assign an owner to the hold. Do not use the new instruction while any required fact, evidence, authority, or approval is unknown, blocked, deferred, or disputed.

The hold is a workflow state, not a statement that fraud occurred. If the team cannot apply it, stop and escalate rather than treating urgency as authorization.

2. Name ownership and separate decision rights

Name the internal commercial owner, verification owner, payment authorizer, real backup, and escalation authority. Commercial ownership, verification execution, and payment authorization are distinct functions even if a small team assigns more than one to the same person.

Combining roles requires a visible exception showing the reason, authority, independence or conflict risk, limit, expiry or exit condition, backup, evidence, and next review. A contractor may execute an authorized verification step but does not become the implicit internal commercial owner or payment authorizer.

3. Select the trusted contact source independently

Choose a source category established outside the request. Record its provenance category and whether it was inspected for freshness. Do not copy the source or contact details into this record.

If the source is unavailable, newly changed, contradictory, stale, or potentially controlled by the requester, use Trusted source pending or Discrepancy — stop and escalate. Do not improvise from the message.

4. Choose a genuinely separate channel

Select a channel category using the independently chosen source. Record why it does not merely repeat the same mailbox, thread, account, or requester-supplied path.

No one channel is universally correct. The guide does not prescribe a callback, portal, video call, in-person method, or waiting period. If no independent route is available, the hold remains and the workflow stops.

5. Verify identity and request authority separately

Record bounded evidence that the contacted party corresponds to the intended counterparty. Separately record bounded evidence that the person or role has authority to request the change.

Familiarity, urgency, job title, voice, video, business context, or control of an account does not automatically establish authority. Identity evidence cannot silently substitute for request-authority evidence.

6. Compare the change without copying sensitive values

Ask the independently reached, authorized party to support or reject the bounded change category. Record only the comparison result. Do not store payment destinations, account details, amounts, invoices, messages, contact data, or another sensitive value in the artifact.

A match is not sufficient when the source, channel, identity, authority, or approval evidence remains uncertain. Any material mismatch becomes a stop and escalation result.

7. Separate commercial approval from payment authorization

The commercial owner confirms whether the business relationship and obligation support the change. The payment authorizer separately decides whether the verified instruction may enter the payment process. Commercial approval is not permission to release funds.

This guide does not define a universal number of approvers, transaction threshold, payment rail, bank procedure, or legal standard. When one person occupies both functions, the exception and residual risk remain visible.

8. Record evidence, discrepancies, and escalation

For every decision, distinguish reported from evidence inspected. Record only a non-sensitive evidence-location reference, its responsible owner, and the bounded conclusion it supports.

Any discrepancy, missing authority, unavailable independent route, potentially corrupted contact record, unusual or irreversible transaction, suspected compromise, or legal/contractual/banking uncertainty keeps the hold active and triggers qualified escalation.

9. Close before release or hand off

Close the record only as one of three outcomes: verified evidence and separated approvals complete; changed instruction rejected; or stopped and escalated. Closure records what happened to the gate. It does not execute or authorize a payment by itself.

Closed — evidence inspected; no payment action performed by this guide does not mean the request, source, channel, counterparty, account, or payment is safe, legally valid, or free from fraud.

Use workflow states, not a fraud score

• Received — hold applied
• Trusted source pending
• Independent channel pending
• Identity evidence inspected
• Authority evidence inspected
• Commercial approval pending
• Payment authorization pending
• Discrepancy — stop and escalate
• Rejected — changed instruction not authorized
• Closed — evidence inspected; no payment action performed by this guide
• Unknown — follow up through approved route
• Blocked — qualified help required
• Deferred — owner and review trigger required

These states describe workflow position, not fraud likelihood, payment safety, legal validity, counterparty integrity, bank acceptance, or protection outcome. A reported confirmation is not automatically inspected evidence.

Stop rather than improvise

Stop when the hold cannot be applied; the contact source is missing or suspect; no independent channel exists; identity, authority, commercial ownership, or payment authorization is unclear; any material information differs; normal controls are challenged; an approver is unavailable, conflicted, or implicated; funds may already have moved; or compromise, fraud, legal, contractual, tax, sanctions, privacy, records, insurance, banking, or law-enforcement questions arise.

These are handoff triggers only. Do not use this guide to investigate, recover funds, contact a bank or law-enforcement body, freeze an account, inspect a mailbox, preserve forensic evidence, notify affected parties, or make a legal, contractual, sanctions, tax, insurance, or fraud determination.

EP-13 owns safe reporting and bounded triage of the suspicious message; EP-14 receives the routed payment concern without copying or analyzing that message. EP-15 owns preparation and qualified-response handoff when mailbox compromise is suspected. EP-11 supplies the common ownership, evidence, exception, residual-risk, escalation, and review vocabulary without reproducing this gate.

Create the 18-field verification record

Use one vertical record for each bounded payment-change request:

1. Received time band and bounded change category: A non-precise window and category only.
2. Transaction hold owner and state: Who owns the hold and whether it is active.
3. Internal commercial owner: The internal role accountable for the business relationship.
4. Verification owner and real backup: Who performs the bounded check and who can genuinely continue it.
5. Payment authorizer: The role authorized to release the instruction into the payment process.
6. Separation-of-duties or exception state: Distinct roles, or a visible bounded exception with conflict and expiry.
7. Trusted contact-source category: The type of record established outside the request.
8. Trusted-source provenance and freshness state: How the source category was established and whether evidence was inspected.
9. Independent channel category: A generic route category, not contact data.
10. Channel-independence rationale: Why it does not repeat the requesting context.
11. Identity-verification state and evidence category: Reported or inspected, with no personal detail.
12. Request-authority state and evidence category: Separate evidence that the role may request the change.
13. Change-detail comparison result: Supported, rejected, discrepant, or unknown—without sensitive values.
14. Commercial approval state: The business owner’s bounded decision.
15. Payment-authorization state: The separate payment role’s bounded decision.
16. Non-sensitive evidence-location reference and inspected/reported distinction: Where authorized evidence is held and whether it was inspected.
17. Discrepancy, stop, escalation, and closure result: The terminal gate outcome and owner.
18. Unresolved risk and next review trigger: What remains uncertain and what reopens the record.

Completion requires truthful fields or visible unknown, blocked, deferred, or discrepancy states. It does not execute a payment, prove identity or authority absolutely, establish legal entitlement, or prove absence of fraud.

Work through a fictional example

Fictional example — do not copy as a completed email-security record. This contains no real or plausible company, person, contact, message, invoice, bank, payment, account, transaction, or incident data.

1. Received time band and bounded change category: Current business period; payment-destination change category.
2. Transaction hold owner and state: Operations owner; Received — hold applied.
3. Internal commercial owner: Business-relationship owner role.
4. Verification owner and real backup: Operations verifier; backup authority confirmed at role level.
5. Payment authorizer: Separate finance-authorizer role.
6. Separation-of-duties or exception state: Roles separated; no exception recorded.
7. Trusted contact-source category: Previously approved internal business record.
8. Trusted-source provenance and freshness state: Provenance documented; freshness evidence inspected.
9. Independent channel category: Independent business channel category.
10. Channel-independence rationale: Selected outside the request and outside its communication context.
11. Identity-verification state and evidence category: Identity evidence inspected; category-level evidence only.
12. Request-authority state and evidence category: Authority evidence inspected; authority category confirmed separately.
13. Change-detail comparison result: Discrepancy found; sensitive values not recorded.
14. Commercial approval state: Withheld pending escalation.
15. Payment-authorization state: Not authorized; hold remains active.
16. Non-sensitive evidence-location reference and inspected/reported distinction: Approved evidence location; evidence inspected rather than merely reported.
17. Discrepancy, stop, escalation, and closure result: Discrepancy — stop and escalate; no payment action performed.
18. Unresolved risk and next review trigger: Contact-record integrity unresolved; review after qualified handoff or ownership change.

Review the gate without claiming protection

Review when business ownership, verification responsibility, payment authority, backup coverage, trusted records, channel availability, approval policy, provider behavior, or official guidance changes. Reopen records when evidence expires, exceptions reach their limit, discrepancies remain unresolved, or people bypass the hold.

The gate is ready for local editorial review when the hold has a real owner, source and channel independence can be explained without sensitive data, identity and authority stay separate, commercial approval and payment authorization stay separate, every exception and discrepancy remains visible, and all stop conditions have qualified destinations. Public use and any live financial process remain separate decisions.