1
Routine
Payment emails are normal, so a fake one blends in. Attackers often study how a company pays people.
How it showed up hereA message that uses the right names and amounts.
Payments, Invoices & Bank-Detail Changes
This short course is required for everyone at Charitybuzz. It takes about ten minutes: a few focused lessons, a quick quiz, and a confirmation that goes on your training record. Everything in it comes from the kinds of messages and requests our team is actually receiving, so what you learn here is what you will use at work.
What this covers How attackers redirect payouts, payments and invoices at an auction company, and the checks that stop a fraudulent transfer.
What this is about
Money moves through Charitybuzz in many directions: payouts to nonprofit partners, payments from winning bidders, payments to vendors and consignors, refunds and payroll. Every one of those flows has a moment where someone can be fooled into sending money, or changing where it goes.
Unlike a stolen password, a completed wire or ACH transfer is often gone for good. The scams are rarely sophisticated. They rely on a believable story, an urgent tone, and a request that "should be quick".
$3.05B
lost to business email compromise (BEC) in 2025
24,768
BEC complaints to the FBI in 2025
#2
rank of BEC among all cybercrime types by dollar loss
Take the message apart
This is the most common way money is stolen from companies like ours: a "partner" changes their bank. Click every detail that should make you stop. There are 6.
0 of 6 red flags found Click anything in this message that looks suspicious.
RE: Q3 payout — updated banking
Hi Jordan,
Following our annual audit, we've moved our accounts to a new bank. Please update our payout details before this week's payout run using the attached letter.
Our old account closes on Friday, so anything sent there after today will bounce and be delayed by weeks.
I'm at a donor event all day and can't take calls, so just reply here once it's done.
Melissa Grant
Finance Director
Hope Harbor Foundation
PDF HopeHarbor_New_Bank_Letter.pdf
188 KB
188 KB
Link goes to:—
Click anything in this message that looks suspicious.
Spot the signs
Quick check: for each request, decide whether it is a red flag or looks fine.
0 of 6 answered
An email from a nonprofit partner saying their bank has changed and asking you to send the next payout to a new accountA change of bank details is the single most common payment scam. Always confirm by phone using a number you already had.
A partner you know calls you from a number on file and talks through a bank change, and you call back a known number to confirmYou verified the change independently, using contact details you already had.
A "leader" asks by text for a wire today and says not to discuss it with anyoneSecrecy and urgency are the scam. Real payments go through the normal approval process with more than one person.
An invoice from a vendor you have never used, with bank details in the email bodyCheck new vendors through the proper onboarding process, not through an invoice that arrived unasked.
A payment request that follows the usual approval steps and matches a purchase orderIt follows the normal process and can be checked against records you control.
A message saying the old account is closing soon, so the payment must go out todayA made-up deadline pushes you to skip verification.
Why this works on smart people
2
Authority
A request that appears to come from a leader or finance lead is hard to question.
How it showed up here"I am in a meeting, please handle this now."
3
Urgency and secrecy
A deadline and a request for discretion stop you from checking.
How it showed up here"Do it today and do not tell anyone."
4
Plausible reasons
Bank changes, audits and closing accounts are reasons that actually happen.
How it showed up here"We moved banks after our annual audit."
How this lands at Charitybuzz
The money scams that fit an auction company look like these:
Finance
The nonprofit partner changes bank details
Someone claiming to be a contact at a nonprofit partner emails that their bank has changed and asks to send the next payout to a new account, with a letter attached.
The tell
The request arrives by email, the address may be a look-alike of the partner's real domain, and there is a deadline.The right move
Do not change anything. Call your contact on a number you already had, and follow the payment-change process with a second person.Finance & Operations
The urgent leadership wire
A message appears to be from a leader asking for an urgent wire or ACH to a new payee and says to keep it private.
The tell
Leaders use the normal approval process. Secrecy is a red flag.The right move
Verify with the leader on Slack or by a number you already had, and with Finance, before anything moves.Accounts payable
The fake vendor or consignor invoice
An invoice arrives from a vendor you do not recognize, or from a known vendor with different bank details.
The tell
The details do not match your records, or the vendor is unfamiliar.The right move
Check it against your vendor records and the purchase order. Confirm any change by phone with a known contact.Red flags to watch for
A change to bank or payment details
Always verify out-of-band. This is the top red flag.
Urgency, "today only", or a closing account
Made up to stop you from checking.
Secrecy: "do not tell anyone"
Real payments need more than one pair of eyes.
A new payee or new account
Treat it with the highest scrutiny.
A sender address that is slightly different
Look for tiny misspellings and extra words in the domain.
Contact only by email or text
Real partners can be reached by phone.
A request that skips the normal process
Any shortcut is the scam.
Gift cards, crypto or unusual payment methods
Not how Charitybuzz pays or collects.
A real payment request
- Follows the normal approval process
- Matches a purchase order or record
- Any change is confirmed by phone with a known contact
- Involves more than one person
- Gives time to check
A fraudulent request
- Changes bank details by email
- Demands speed and secrecy
- Comes from a look-alike address
- Uses a new account or payee
- Avoids phone confirmation
What to do instead
Stop and do not act on the message
Nothing about a payment is so urgent it cannot wait for a check.
Confirm by phone, using a number you already had
Not the number in the message. Use the contact details in your own records.
Use two sets of eyes
Any change to payment details should be approved by a second person.
Check against your records
Compare amounts, names and bank details with the original agreement or purchase order.
Report it
Tell John and Finance, and use Gmail's Report phishing.
If you clicked — or entered something
Sent a payment? Contact your bank and Finance within the hour
Ask the bank to recall or freeze the transfer. Speed gives the best chance of getting money back.
Changed payee details? Reverse the change and tell John
Check recent payments to the changed account and whether any are in flight.
Report it — even if you think you got away with it
In Gmail, open the message, click the ⋮ menu and choose Report phishing. Then email [email protected] with a one-line summary of what you did (clicked, opened a file, typed a password, approved a prompt). Fast reports let IT block the sender for everyone.
Typed your password? Change it now
From a device you trust, go to myaccount.google.com by typing it yourself, change your password, and review Security → Your devices. If you reuse that password anywhere else, change it there too.
Approved a sign-in prompt or read out a code? Call IT immediately
This is the most urgent case: the attacker may already be in your account. Contact Charitybuzz IT ([email protected]) right away so they can end every session and reset access.
Opened an attachment or installed something? Stop and tell IT
Don't keep working on that device and don't try to "clean it up" yourself. Leave it on, disconnect it from Wi‑Fi if you can, and contact IT.
Key takeaways
- Any change to bank details gets a phone call to a number you already had.
- Urgency and secrecy are signs of fraud, not of importance.
- Real payments follow the normal process with a second approver.
- Check the exact sender domain for tiny differences.
- If money has moved, call the bank and Finance within the hour.
Knowledge check
Confirm your training record
This creates the completion record Charitybuzz keeps for compliance. Please use your work details.
Training complete
Your completion has been recorded. Thank you for helping keep Charitybuzz, our nonprofit partners, and our bidders safe.
Certificate ID: —
View & print certificateKeep this handy
- Any change to bank details gets a phone call to a number you already had.
- Urgency and secrecy are signs of fraud, not of importance.
- Real payments follow the normal process with a second approver.
- Check the exact sender domain for tiny differences.
- If money has moved, call the bank and Finance within the hour.