Pause changed instructions.

By Tyler Mayberry · Cirlet. Published October 22, 2026. This is a preparation worksheet; the worked examples are fictional.

A message can look familiar and still contain an unauthorized change. Before acting on changed payment instructions, follow your approved verification and approval procedure through a trusted contact route. This worksheet helps name the people and evidence in that process.

Separate the decisions.

• Request: what exactly changed, and who is requesting it?
• Verification: which contact already in approved records will confirm the specific change?
• Approval: who is authorized to approve it under your agency’s procedure?
• Record: where will the verification and decision be retained?
• Escalation: who handles an urgent request that cannot be confirmed?

A fictional request

A message appears to come from a familiar vendor and supplies new payment details plus a new callback number. The employee does not use that new number to verify the same request. They use the approved contact already recorded, confirm the specific instructions and follow the agency’s approval process. If verification fails, the request is escalated.

Practice without a transfer.

Use fictional names and no bank details. Ask a staff member to identify the trusted contact and backup approver. Record any missing ownership or contact evidence. Do not perform a real transfer to test this worksheet.

Why AI changes the question

Voice impersonation is a documented technique, but staff do not need to prove that a request used AI before verifying it. Read the sourced impersonation playbook.

This is an operational preparation worksheet. It does not replace your institution’s fraud procedures, professional advice or established incident response.