Dental Payment-Change Fraud: A BEC Verification Guide

The FBI explains that criminals can spoof addresses, use targeted phishing, or obtain access to legitimate email conversations. A message that includes a correct purchase order or earlier discussion therefore deserves the same independent check when it changes where money will go. The issue is the authority for the change, rather than whether the sender sounds familiar.

In a dental office, plausible scenarios include a lab changing its remittance account, an equipment supplier requesting a different deposit destination, or someone impersonating a practice owner during a busy patient day. These are illustrative scenarios, not reports of attacks on particular practices. Keep the verification step consistent across known suppliers, new vendors, and urgent exceptions.

Pause the payee update and payment. Reach the supplier using a number or contact path established before the change request, such as the approved vendor record. Do not use a replacement phone number, QR code, or verification link supplied in the suspicious message. Replying to the same thread can simply return the question to the person controlling it.

Ask the known contact to confirm the change through the practice's approved process. Record who verified it, which trusted route was used, when the check occurred, and who authorized the next step. Avoid putting complete bank details into a broadly visible support ticket. The payment owner should decide what evidence belongs in the restricted financial record.

Use a written workflow that distinguishes receiving an invoice, changing a vendor record, and releasing a payment. Where staffing permits, have another authorized person review a changed destination before the transaction proceeds. Smaller offices can define an owner review or another practical control instead of pretending that they have a separate finance department.

Document what happens when the approver is unavailable. Urgency should route the request to an approved alternate, rather than remove verification. The practice sets its own financial authority and escalation limits; this article does not create a legal requirement for a particular number of approvers, payment threshold, or hold period. Dental IT can support the workflow but cannot authorize a transfer.

Follow the FBI's advice to enable MFA where available and treat unexpected requests carefully. Have IT investigate suspicious mailbox access, forwarding rules, application permissions, and account recovery settings within the actual platform. A successful login or a clean-looking attachment does not validate a supplier's new bank account.

Connect this work to the <a href="/blog/dental-oauth-app-consent-security-2026/">application-consent review</a> and the <a href="/tech-support/dental-cybersecurity/">dental cybersecurity service</a>. Those controls address access paths, while the callback process addresses the business decision. Staff should know both where to report a suspicious email and who can approve a legitimate payee change.

The FBI advises contacting the financial institution immediately and asking it to contact the institution where the transfer was sent. Also report BEC to IC3. Keep the transaction reference, time, receiving-account information, original message, and known contact history available through a restricted route. Speed matters, but recovery is not guaranteed.

Notify practice leadership and IT so financial response and technical investigation can proceed together. If a practice mailbox may be compromised, use a separately verified communication path for the response team. Follow the bank's instructions and the practice's incident process. Do not promise that deleting a message, resetting a password, or filing a report will recover funds or fully remove unauthorized access.

Run a short exercise using a fictional supplier and account. Give the front desk a message requesting a changed destination and ask staff to demonstrate the known contact lookup, verification record, approver handoff, and unresolved-request status. No real payment or account change is needed. Include the person who covers lunch or closing duties.

Review where the exercise stalls: missing vendor numbers, owner-only knowledge, inaccessible approval records, or a callback that returns to the suspicious email. Update the contact and responsibility records rather than blaming the person who found the gap. Link the exercise to the <a href="/blog/dental-business-continuity-drill-2026/">continuity drill</a> and <a href="/tech-support/managed-it-support/">managed support process</a>.

Create a small record with the supplier's established identity, the request date, the person receiving it, the changed field, the trusted verification route, the verifier's name, approval status, and the payment reference when applicable. Store sensitive evidence only in the approved financial system. A support ticket can reference that record without copying its confidential contents.

Use clear outcomes: pending verification, rejected and escalated, or independently confirmed and approved. Do not mark a request safe merely because a message was delivered successfully or passed a technical email check. For an unresolved request, identify the next owner and keep the payment paused under the practice's policy. Review the process whenever a supplier or payment platform changes.

A fraudulent invoice is not automatically a patient-data breach. Conversely, a compromised mailbox can involve information beyond the payment request. Have the practice's privacy and incident leads assess what data and access were involved rather than using the amount lost as a privacy conclusion. Follow applicable obligations based on the facts.

Use the <a href="/resources/start-here/">provider evaluation guide</a> to ask how financial staff, IT, and incident specialists coordinate. Keep payment recovery, account containment, evidence review, and privacy assessment visible as separate tasks with named owners. No security product or callback script guarantees fraud prevention.

Consider a fictional Friday request from a supplier that says an equipment deposit must be redirected before closing. The usual payment approver is away. The staff member receiving the request should locate the existing supplier record and the approved alternate approver, then record that verification is pending. The message's urgency does not establish a new financial authority. If the known supplier contact cannot be reached, the alternate should follow the practice's exception policy rather than use the replacement number in the message.

At the next team review, ask four concrete questions: could the receiving employee find the known contact; could the alternate understand the proposed change without relying on the email; was the approval outcome recorded in the appropriate restricted location; and did the financial team know whether payment remained paused? Keep the exercise fictional, with no real account numbers or transfer. If the workflow lacks an alternate, leadership should decide that responsibility before another request arrives. IT can maintain the approved contact route and investigate a suspicious message, but the practice's authorized financial role decides whether a verified change is accepted. This rehearsal tests a business control without implying a specific supplier has been compromised.