A vendor emailed asking us to update their bank details before the next payment. How do we know it is really them?

This is the payoff at the end of most stolen-mailbox attacks. The attacker is not guessing at your suppliers. They got into somebody's email, usually through a fake sign in page, and then read quietly for weeks to learn who invoices you, for how much, and what the normal back and forth sounds like.

That is why these messages are so convincing. There is often no urgency and no spelling error, because the attacker is copying a real thread. Sometimes the request genuinely does come from the vendor's own account, which means every technical check you would normally lean on comes back clean.

So the check cannot be technical. Make it procedural and make it boring: any request to change bank details, a routing number, or a remittance address gets confirmed by phone, on a number you already have on file, with a person whose voice you recognize. Never the number in the message, and never a reply to the thread.

Put the rule in writing and tell your vendors you follow it. Real vendors tend to be relieved, because they are being targeted too. It also protects whoever in your office has to push back on what looks like a routine request from a good client, which is the part of this that is hardest to get right.

If a payment already went out, call your bank first, because how much can be recovered depends heavily on how fast it is reported. Then tell whoever handles your IT, since if the compromised mailbox turns out to be yours rather than the vendor's, the same attacker is sitting quietly in your other conversations.