Retrospective: the week of May 5, 2026, during National Small Business Week. This article was prepared later and was not published in May. Its purchasing recommendations draw on the dated federal guidance linked below, with reporting resources checked during preparation.
The right company name on an invoice does not prove that the bank account belongs to that company. Tennessee businesses buying guard coverage, alarm monitoring or a camera installation should verify both before releasing a payment.
The Small Business Administration scheduled National Small Business Week for May 3-9, 2026, with an online summit scheduled for May 5-6. It published those dates in an April 21 announcement. For owners handling security purchases without a large finance department, the week offered a useful occasion to check how money leaves the business. SBA’s dated 2026 announcement.
This is a purchasing-control guide, not a report of a newly discovered Tennessee fraud wave. If a familiar supplier sends new payment instructions, the person paying the bill needs a way to verify them without relying on the message that requested the change.
Two checks, because there are two different problems
A fake invoice may ask for a service nobody ordered. The FTC’s small-business guide describes that tactic and recommends clear procedures for approving purchases and checking invoices. The first check is whether the business owes the money at all. FTC guide, July 2023 edition.
Business email compromise can involve a real supplier and a real payment. The deception concerns who is asking and where the money will go. In a February 2017 explanation, the FBI described criminals studying an organization’s vendors and billing practices before sending fraudulent transfer requests. It advised confirming requests through a known telephone number and adding a second approval for changes in vendor-payment arrangements. FBI explanation and safeguards.
For a security contract, compare the invoice with the agreed service period, approved rates and documented additions. Was the extra weekend shift authorized? Does the equipment bill match the accepted quote? Those questions help establish the debt, but they do not authenticate a replacement bank account.
Treat a payment-detail change as its own decision, even when the invoice total is correct. A familiar building address, purchase-order number or email signature should not substitute for that check.
An ordinary billing mistake is also possible. Hold an unclear item for clarification without accusing the supplier of fraud; the aim is to resolve uncertainty before sending money, not to turn every disagreement into an allegation.
Same invoice. Different decision.
Put the verification route in the vendor file
Record the supplier’s billing contact when the relationship begins. Verify it through a channel separate from the first payment request, then keep it with the contract and approved payment instructions. For an existing supplier, review that record while there is no urgent transfer pending.
Who is allowed to change it? Give that question an answer.
If anyone who receives an email can overwrite the stored contact number and bank details, the record will not provide an independent check when it is needed. Limit those changes to named staff and keep a record of the verification. This is an editorial recommendation for a small-business process, not a claim that a specific approval workflow is legally required in Tennessee, nor a reason to collect personal information unrelated to the payment.
The record need not be elaborate. It can identify the legal business name, the verified billing contact, where the approved payment instructions are stored, and who approved the latest change. Keep bank details in the business’s protected payment system rather than copying them into visitor logs, guard post orders or a shared noticeboard.
Plan for absences. If the owner normally approves supplier changes, identify a backup who can complete the same check. Otherwise, the process may fail at exactly the point when someone says the payment cannot wait until the owner returns.
Make the policy available to the supplier, too. A legitimate accounts team should know which contact to use for a change request and why a new account will not be accepted solely through an emailed invoice.
Call back using information you already trust
Consider a hypothetical alarm-maintenance invoice. The amount and service date match the contract, but an accompanying email says the company has changed banks and payment is due that afternoon. The request might be genuine. It still needs verification.
Use the contact number already held in the verified vendor record. Do not substitute a new number from the message under review. The FBI’s dated guidance specifically recommends previously known numbers and a separate sign-off for changed payment arrangements, two controls that remain useful when the message is polished, correctly timed and threaded into a real business conversation. FBI safeguards.
Ask the established contact whether the company requested the change and how its authorized billing staff will confirm the new instructions. Record the date, the person reached and the outcome. Where the contact cannot confirm it, leave the change pending and escalate through the supplier’s established management channel.
An incoming call does not complete the same check. The FTC warns that caller ID can be faked. Nor does another message in the original email thread necessarily resolve the problem, because the FBI describes attacks that give criminals access to genuine billing correspondence, the very context an employee might otherwise treat as proof. FTC small-business guidance; FBI account-compromise explanation.
Keep the second approval meaningful. The second reviewer should see the verification record and compare the proposed change with the vendor file, rather than approving because the first person has already clicked a button.
For a business with only one person handling payments, a separate employee may not be available. The independent callback still matters; ask the bank about available payment controls and decide how exceptional changes will receive additional review. Do not invent a second approval on paper that nobody actually performs.
Make urgent requests follow the same path
An urgent security need and an urgent bank-detail change are separate issues. The owner may need to authorize extra coverage quickly while still requiring the billing team to confirm where a payment will go.
Decide in advance who can approve additional work, what evidence the accounts team receives, and how a supplier can raise a genuine overdue balance. A guard supervisor’s approval of a replacement officer should not silently become authority to change the supplier’s bank account.
During a provider handover, retain the old and new contracts in distinct records. Mark the final service date for the departing provider, identify unresolved charges, and confirm the new provider’s payment instructions independently. A familiar site name appearing on both invoices is not enough to decide which service each bill covers.
Try the process before relying on it. Use a clearly labeled practice example with no real bank details or money movement: a duplicate invoice, a changed account request, or a demand from someone claiming to be the owner. Ask staff where they would verify the request, whom they would contact if the usual approver were unavailable, and what information they would preserve if the request turned out to be false.
The exercise should find gaps in the procedure, not embarrass an employee. The FTC encourages businesses to explain scams to staff and make it acceptable to raise suspicions with coworkers. A person who pauses a questionable payment needs a usable escalation route. FTC small-business guide.
If money has already gone, act promptly
Contact the financial institution immediately and ask it to contact the institution that received the transfer. Report suspected business email compromise to the FBI’s Internet Crime Complaint Center at IC3.gov. Those steps appear in the FBI’s 2017 guidance and remain on its current BEC information page. A report does not guarantee recovery. FBI reporting guidance.
Preserve the invoice, messages, payment confirmation and verification notes for the bank, investigators and the business’s incident-response team. Keep further communication with the real supplier on a separately verified channel. If an account may be compromised, have the responsible IT support investigate rather than continuing to trust that mailbox.
Fake invoices and other scams can also be reported through ReportFraud.ftc.gov. Follow the bank’s and investigators’ instructions about the information they need, and avoid circulating complete account details more widely than necessary.
A supplier can be properly licensed and still have its name misused in a fraudulent request.
Verify the service, the requester and the destination before the payment leaves your control.