Verify requests through a separate channel

An email may look as if it came from a manager, colleague, or supplier. An account could be compromised or an address spoofed. Do not rely on appearance alone for requests involving money or sensitive information.

Do not reply in the same thread

Call using a number you already have or ask through a familiar team channel. If the message provides new contact details, check them against an independent source.

Repeat the amount, recipient, and deadline during the conversation. Follow the usual approval steps. If the person cannot be reached, hold the action until you can verify it.

A separate check reduces the chance of acting on a compromised account or convincing imitation. FTC guidance on phishing.