Scam Alert! – Manager or Colleague “Urgent Payment” Impersonation (Messaging & Email)

Reviewed by ScamReporting.org Editorial Team · Editorial standards

Reported August 2026 — Banks, employers, and fraud agencies worldwide are warning about urgent payment requests that appear to come from a trusted manager or senior colleague after a phone compromise or contact spoof.

Quick answer

If your manager, CFO, or a senior colleague messages you out of the blue asking for an immediate wire, ACH, or same-day transfer to a new account, stop. Call them on a number you already have on file — or walk over and confirm in person — before releasing any payment. This pattern is reported globally, not limited to one country or bank.

Sample message (anonymized pattern)

Real cases often look like a familiar name and profile photo in WhatsApp, Teams, SMS, or email. The wording varies, but the pressure and secrecy are consistent:

From: James Porter — Finance Director (display name matches your real contact)

Hi — I’m tied up in a confidential client call and can’t talk. Need you to process an urgent vendor refund today before cutoff. Please transfer $12,850 to the account below and confirm once sent. Keep this between us until the audit clears.

New payment details:
Beneficiary: Apex Trade Solutions Ltd
Account / IBAN: [redacted]
Reference: URG-4421

I’ll explain after the board meeting. Thanks — JP

The sender may use your colleague’s saved photo, a look-alike email address, or a phone number that was altered after malware or SIM-related compromise. The fraud is often discovered only during a later accounts audit.

How this scam works

1. Account or device compromise: Malware, SIM swap, or stolen session tokens give criminals access to messaging apps or let them edit saved contact details on a compromised phone.
2. Trusted impersonation: Messages arrive from what looks like your manager, finance lead, or a senior colleague — complete with familiar display names and photos.
3. Urgent payment hook: They request funds to a new bank account, citing emergencies, confidential deals, vendor refunds, or payroll errors.
4. Secrecy and speed: They ask you not to discuss the request with others and to act before end of day, cutoff, or a fake audit deadline.
5. Silent loss: Because the request mimics normal workflow, the transfer may not be questioned until reconciliation or an external audit.

Red flags

• Unexpected payment request from a senior contact you normally wouldn’t pay without approval
• Insistence on a new beneficiary account not on your vendor master list
• Pressure to skip standard dual approval, procurement, or finance review
• Requests for secrecy — “don’t loop in AP” or “confidential until tomorrow”
• Communication only through chat or email; refusal to confirm on a known phone extension or video call
• Spelling or tone slightly off, or sent outside normal business hours for that person

What to do

• Pause the payment — no legitimate urgent transfer requires bypassing verification.
• Verify out-of-band: Call your manager or colleague using a number from your company directory, not the one in the message. For large wires, confirm in person or on a scheduled video call with a known participant.
• Follow your company’s wire policy — dual authorization, callback procedures, and vendor change forms exist for this exact threat.
• Paste suspicious text into our Scam Checker or search sender details in Scammer Lookup.
• Report internally to IT/security and finance, and externally to your national fraud line — e.g. the FTC at ReportFraud.ftc.gov (U.S.), Action Fraud (UK), or IC3 for business wire fraud at ic3.gov.
• File with us: Report a Scam helps other readers spot the same script.

This attack sits alongside classic business email compromise (BEC) — same goal, different channel. Employees, accountants, and executive assistants are common targets worldwide.

Reminder: ScamReporting.org is an independent awareness resource — not law enforcement or your bank. If you already sent money, see recovery steps and contact your bank’s fraud department immediately.