A believable email asking a finance team to use a “new bank account” can be more dangerous than an obvious spam message. Criminals may copy an executive’s tone, compromise a supplier mailbox or register a lookalike domain. The payment request can arrive inside a genuine conversation, so staff need a verification process that does not depend on appearance.
The UAE Cyber Security Council’s official Stay Safe service lets users check whether a website or link appears legitimate, phishing or fraudulent. It is one useful check, not a replacement for calling the supplier through trusted contact details and applying internal payment controls.
Common warning signs
| Signal | Why it matters | Safer response |
|---|---|---|
| New bank account | Redirects a legitimate payment | Verify through a known contact |
| Urgent confidentiality | Discourages normal approval | Pause and escalate |
| Lookalike domain | Impersonates a supplier or executive | Compare every character |
| Changed invoice attachment | May contain altered details or malware | Open through controlled systems |
| Unusual payment route | Breaks normal business pattern | Require documented approval |
Verify through a separate channel
Do not reply to the suspicious email or use the telephone number printed on the changed invoice. Call a previously verified supplier contact from the approved master record. Ask the contact to confirm the requested change, then require the organisation’s normal written bank-change documents and approvals.
- Stop the payment when details change unexpectedly
- Compare the full sender domain, not only the display name
- Call a known contact using an independently stored number
- Require dual approval for new beneficiaries and bank changes
- Record who verified the request, when and how
- Limit finance-system access and review permissions
- Preserve evidence if fraud is suspected
The UAE cyber-incident guide provides a first-hour structure. The business record-keeping guide helps maintain approvals and supplier master-data history.
Design payment controls before an incident
Separate the person who creates a beneficiary from the person who approves payment. Set transaction limits, use bank alerts and review dormant beneficiaries. A rushed payment should not bypass verification merely because the message names a senior executive.
Invoices should match purchase orders, contracts, delivery evidence and tax records. Our UAE VAT invoice guide covers invoice checks, while the cashless-payments checklist covers reconciliation.
If a payment has already been sent
Contact the bank immediately through its official fraud channel and ask whether the transfer can be stopped or recalled. Do not wait for a full internal investigation before alerting the bank. Preserve the original email with headers, attachment, payment instruction, bank confirmation and communication log.
Report the incident through the appropriate official cybercrime or police channel and follow professional advice. Do not delete the mailbox, wipe a device or publicly accuse a supplier before facts are established. The Dubai dispute-records guide explains neutral evidence timelines, and the responsible-sharing guide helps avoid unverified public claims.
Train staff with realistic examples
Training should include finance, procurement, executives and anyone who can change supplier details. Test lookalike domains, unexpected QR codes, fake shared-document links and urgent payment language. Staff need a clear way to report a suspicious message without embarrassment or delay.
Use secure signing and document checks where appropriate; our UAE electronic-signatures guide explains validation. Review controls after every near miss and record the corrective action.
Questions people often ask
Is a familiar email thread proof that a payment request is genuine?
No. A mailbox may be compromised, so verify changed bank details through a separate trusted channel.
Should finance call the number on the new invoice?
No. Use a previously verified number from the supplier master record or official source.
What should happen when a beneficiary changes?
Pause payment, verify independently, document the change and require the organisation’s normal approvals.
What if the transfer has already been sent?
Contact the bank immediately, preserve evidence and report through the appropriate official channel.
Can a link-checking tool guarantee that an email is safe?
No. It is one signal only; payment verification and internal controls are still required.
