The research question
A company can be real while a payment instruction bearing its name is false. A registration report answers questions about the company; it does not establish that a particular email or bank-account change came from an authorised contact. Build that distinction into the way purchasing and finance teams handle changes.
Verify the request through a separate channel
The FBI describes business email compromise as a fraud affecting business payments and recommends verifying changes to account numbers or payment procedures. It advises finding a contact number independently rather than using one supplied in a potentially fraudulent message, and treating pressure to act quickly with caution. FBI business email compromise guidance
For your internal process, assign somebody to verify the instruction and somebody to approve its implementation. Record which known contact was reached, through which independently established channel, and what exactly they confirmed. Avoid a record that merely says 'checked': a later reviewer needs to understand the evidence.
Ask about the instruction, not just the company
Clarify the requested account holder, the effective date, the invoices affected, and the business reason given for the change. Keep the original message and supporting material in the case record. If the explanation introduces a different group entity or intermediary, treat that as an additional question for the responsible finance team.
A current company profile can help establish the counterparty's identity and known corporate relationships. It cannot authenticate the sender of an email, prove control of a bank account, or replace your payment approval process. Choose research that addresses the remaining identity question instead of assuming a broader report verifies the instruction.
Do not let a plausible story close the case
Hypothetical example: an established supplier emails shortly before an invoice falls due and says its usual account is under maintenance. The finance team does not rely on the email signature or the attached letter. It uses its existing independently verified contact route, documents the response, and applies its internal change-approval procedure before releasing the payment.
The important research lesson is that an authentic document about one fact can sit beside an unverified claim about another. A registry extract showing a company exists is not evidence that a bank-change letter was issued by that company.
Keep the handover specific
If verification remains unresolved, state that the payment instruction has not been authenticated and name the outstanding step. If funds have already been sent and fraud is suspected, contact the financial institution promptly; the FBI also directs victims to report the matter through the relevant reporting channel. Local reporting arrangements should be checked for the transaction concerned. FBI response guidance
What to take away
- Company verification and payment-instruction verification answer different questions.
- Use independently established contact information for confirmation.
- Document exactly what was authenticated and what remains unresolved.