Check the sender closely
- Expand the full email address and compare every letter of the domain.
- A familiar display name can hide an unrelated address.
- Be suspicious when a normal vendor suddenly uses a personal mailbox or new banking details.
Inspect the request
- Urgency, secrecy, changed payment instructions, and unusual gift-card requests are major warnings.
- Do not open Office files that demand macros or sign in through an unexpected link.
- Compare invoice numbers, purchase orders, and prior conversation history.
Verify outside the email
- Call a known vendor number from your records, not the message.
- Use a two-person approval process for payment-detail changes.
- Report the message so other staff do not process the same request.
Stop guessing when the problem keeps coming back
Get help immediately if an attachment was opened, credentials were entered, or money was sent using fraudulent instructions.