What to do first

If a message changes payment details

Pause. Verify the request through a known channel, preserve the message and follow your organization’s approved IT or security route.

Business email impersonation is a message designed to look as if it came from a trusted person or organization. It may ask for a payment change, login action or sensitive information. The key is to verify the request independently before acting.

How impersonation works

The display name, reply address and apparent urgency can all be used to create a false sense of familiarity. A payment-change request deserves a separate verification path.

Fictional example — not a real customer message

Display name: Your Supplier Accounts

Sender: accounts@your-suppIier.example (look closely at the spelling)

Subject: Updated payment details for this month

“Please use our new bank account today to avoid delay.”

Safer next step: Call the supplier using a number you already trust, not one in this message.

Signals worth checking

  • Sender domain differs from the familiar domain.
  • Urgency or secrecy is used to discourage verification.
  • Payment or account details change unexpectedly.
  • A link asks you to sign in outside your usual workflow.

A simple verification workflow

  1. Pause before clicking or paying.
  2. Use a contact detail already on file to verify the request.
  3. Preserve the message and notify the approved internal IT/security route.
  4. Record what was verified and who approved the next action.

Where TSN fits

TSN can discuss business email protection and optional awareness training for Microsoft 365 or Google Workspace. The exact option and rollout depend on your environment.

Explore Email Security

Questions and related reading

Can a familiar display name be misleading?

Yes. Check the full sender address and verify unusual requests through a known channel.

Does email protection replace a callback?

No. A human verification step remains useful for sensitive requests.

Compare email and endpoint protection