Message: “Our bank details changed; pay the replacement invoice today.”
Check: call the supplier using an independently stored number
Control: a second approver verifies payment-detail changes
Record: retain the message and the verification outcome