Among the frauds that hit ordinary businesses, few are as effective as the redirected payment. It works like this: a message arrives that looks entirely legitimate - an invoice from a supplier you really use, a request from someone who appears to be a colleague or a client, often continuing a conversation that genuinely happened. Everything looks normal except one thing: the bank account the money should go to has changed. The email may explain it away smoothly - a new bank, an updated account, a temporary arrangement - and because the rest of the message is familiar and the amount is expected, the payment goes out. It lands in the fraudster's account, and by the time anyone notices, the money is gone.
What makes this so dangerous is that it does not rely on breaking anything. There is no obvious virus and often no dramatic warning sign. The fraudster has either made an email that closely imitates a real sender, or in some cases has gained access to a real account and is watching real conversations, waiting for a genuine invoice to intercept. The request to pay is expected; only the destination is wrong. Because it exploits routine and trust rather than technology, the usual instinct - the payment looks normal, so pay it - is exactly what the fraud depends on.
The single most powerful defence costs nothing and takes a few minutes: treat any change of bank details as something to verify independently, every time, before paying. That means not replying to the email and not calling a number printed on the new invoice, because if the message is fraudulent so is its contact information. Instead, reach the supplier or the colleague through a channel you already had - a phone number you have used before, a contact you know is real - and confirm out loud that the details really changed. A genuine supplier will not mind the check; a fraudster cannot survive it.
It helps to make this a stated rule rather than a personal caution, so it does not depend on one person being suspicious on a busy day. Any change to payment details, or any first-time payment to a new account, gets confirmed through a known channel before it is sent, and everyone who can authorise a payment knows that rule applies to them. Larger or unusual payments deserve a second pair of eyes as a matter of course. None of this slows a business down in any meaningful way, and it stands directly in front of one of the few mistakes that can cost a serious sum in a single afternoon.