A supplier emailed us new bank details. How do we check?

This is the most common version of the attack for an ordinary business, and it is the one worth drilling into everyone who touches accounts payable.

What to do, in order:

• Find the supplier's number somewhere other than the email. From a previous invoice, your accounting system, their website that you navigated to yourself, or a business card. Not the signature block of the message, not a number in the attachment, not a number someone texts you. The attacker controls everything inside that email, including the phone number, and will cheerfully answer when you call it.
• Call and ask for a specific person you have dealt with before. Not the main line and whoever picks up. Say that you received a request to change banking details and ask them to confirm the details back to you, rather than reading the new ones out for them to agree with. People say yes to things read to them.
• If anything is off, stop and tell us and tell your supplier's finance contact. If their mailbox is the one that is compromised, you may be the first person to find out, and they will want to know within the hour.

Do not use email to verify an email. Replying to ask "is this really you" goes to the person sitting in the mailbox, and they will confirm enthusiastically. If they have set a rule, your question may never reach the real person at all.

Signs worth a second look, though none of them are reliable enough to use as an all clear:

• A reply-to address that differs from the sender address, or a domain off by one character.
• Urgency or a reason you should not call, such as being in meetings all week or travelling.
• The account name not matching the company name, or the bank being in a different state or country than the business.
• A thread that has been unusually quiet, then resumes with a payment request.

And the point that makes this worth the two minutes: if the money goes to the wrong account, it is almost always your loss. You still owe the supplier, because you did not pay them. Recovery depends on catching it within hours. A phone call before the payment is a great deal cheaper than the alternative, and no legitimate supplier has ever been annoyed by it.