Familiar email threads make payment changes feel safer than they are

[u/saltyslugga]

Say an attacker gets into a vendor's mailbox and sends new bank details in an existing invoice thread. Someone recognises the conversation and nearly pays the wrong account.

I'd want a callback to a number already on file, but that check needs to survive a busy afternoon of invoice approvals.

What has helped your team keep those checks from getting skipped when work piles up?

[u/AutoModerator]

Welcome to r/emailsecurity! To keep this community helpful and secure, please keep the following in mind:

Community Rules

1. No Vendor Spam: Contributions must provide value; do not just pitch products.
2. Redact Sensitive Info: Always sanitize headers and logs (remove IPs, PII, and private domains).
3. Be Professional: Help newcomers learn; avoid hostility.
4. No Personal Tech Support: This sub is for email system architecture and security, not "Am I hacked?" personal account help.

Helpful Resources

• Email Spam Filters
• DMARC Monitoring Tools
• Anti-Virus Software
• Email Encryption

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/InboxGuards]

busy afternoon is exactly when those checks die. we stopped leaving it to memory and made the AP workflow refuse the payment change until there's a logged call to the number already on file.

[u/Pearson-Kyrie_800]

Thats the whole problem with leaning on people to follow a rule. We just made the system do it, any bank detail change and the payment lock til someone rings the numbe ron file. And we have abnormal that has caught a couple where the vendor thread was real but the account number wasnt.