Hold first, investigate second
If the request changes payment details, asks for an unusual transfer, or claims executive urgency, hold the payment until the evidence is reviewed.
Verify out of band
Use a known supplier phone number, saved finance contact, or official portal. Do not rely on contact details supplied inside the suspicious email thread.
Record what changed
Capture sender details, requested payment amount, account changes, and who confirmed the request. That record helps prevent repeated attempts later.