How businesses can verify suspicious email requests

An employee opens an email from a supplier they deal with every week. The message refers to an invoice they recognize and asks them to use new bank details. There is no attachment to scan. The request arrives just before the payment run, when the person processing it has several other invoices to clear. In that moment, the most useful security control may be a phone number the employee already has for the supplier.

In our analysis of U.S. Google search estimates, searches for "how to block scam email" rose 52% over 12 months. Searches for "how to stop spam emails" rose 49%, and searches for "how to stop getting junk email" rose 39%. Those figures tell us what people are looking for help with. For business leaders, they raise a practical question. Once an email reaches an employee, how easy is it for that person to check what the message is asking them to do?

Decide which requests need a second check

I would start with requests that can move money, disclose sensitive information or give someone access to an account. A supplier changing its bank details, an executive asking for payroll records and an unexpected instruction to install security software all warrant a separate check. Write that requirement into the workflow, especially when a message claims there is a deadline or asks the recipient to keep the matter confidential.

For a supplier payment change, call an established contact using the number already in your records. Ask the supplier to confirm the change before updating the payment details. If the usual contact is unavailable, give staff an escalation route and authority to pause the payment. Otherwise, employees are left to choose between following a security procedure and meeting a deadline they are accountable for.

A familiar sender can make that pause feel unnecessary. If a criminal gains access to a real mailbox, they may be able to reply inside an existing conversation. The invoice history and the relationship may both be genuine. What needs checking is the new instruction.

Make genuine security instructions easy to recognize

IT teams can reduce uncertainty by telling employees how they normally issue security instructions. If updates are delivered through a managed device tool or a known help desk portal, staff should know where to find it. When an unexpected email tells someone to run a command, install software or approve a sign-in, they should be able to check with IT through a route they already use.

The same approach applies to shared documents and account alerts. If a message says there is a document waiting for you, open the service from a saved bookmark or your usual app. If the request still looks unusual, confirm it with the colleague through an established channel. The procedure should be simple enough to follow during a busy workday.

Email filtering and phishing-resistant sign-ins, such as passkeys or security keys where supported, can reduce risk. A clear verification procedure helps with a different decision. Even someone who signs in securely can be persuaded to update a supplier's details or approve an unexpected request. That decision needs a check of its own.

Give employees a reason to report quickly

Ask staff to report suspicious messages promptly, including when they have already clicked a link or entered information. The first questions should help the response team act. Did the employee open the link, enter credentials, approve access, install software or send money? Each answer points to a different next step.

If credentials were disclosed, the employee should reset the password through the genuine service and notify IT so the team can review active sessions and any access that may have been granted. If money was sent or payment details were exposed, contact the financial institution immediately and alert the internal team responsible for payments. Tell staff whom to contact and where to find those details before an incident happens.

I would also practice the process with the teams most likely to encounter these requests. Give finance a mock invoice change and ask how they would reach the supplier. Give another team a fake IT warning and ask where they would verify it. Pay attention to where people hesitate. If they cannot find the right number, do not know who can hold a payment or are unsure whether to report a click, those are specific problems you can fix.

The next suspicious email may look like a receipt, a document a colleague was expecting or an instruction from IT. Give employees a known place to verify the request, permission to pause and a straightforward way to report what happened. Those three decisions are worth rehearsing before the next message arrives.