Fraudulent payment instructions: a property manager’s documentation checklist

A new vendor account, revised owner payment direction, or urgent invoice can break a routine approval path. Keep the original instruction, sender details, approvals, confirmation method, payment record, and any later correction. These facts support internal investigation and create the starting point for a policy-specific discussion.

Retain emails, messages, bank confirmations, invoice history, call notes, user access records, and reconciliation reports. Record the chronology while it is fresh: when the instruction arrived, who verified it, who authorized payment, and when the discrepancy was discovered. Avoid editing the source records.

Identify the relevant crime or cyber form, funds-transfer fraud and social-engineering language, limits, deductibles, discovery and notice conditions, and any verification requirements. Do not assume that a payment made after deception is treated the same way as an unauthorized transfer. The issued form needs to be read against the facts.

Use the incident record to test call-back procedures, segregated approval, vendor-master changes, and reconciliation timing. FBI Internet Crime Complaint Center guidance can support the operational-control conversation. Policy wording, declarations, and endorsements control; follow the policy’s reporting instructions for an actual loss or notice.

• Original instruction and verification
• Approval and payment timeline
• Policy and notice documents
• Control update owner and date

If a vendor or owner payment may have been redirected, pause pending transfers through the organization’s established authority path and contact the financial institution promptly using a known channel. The FBI Internet Crime Complaint Center recommends rapid bank contact when business-email-compromise fraud is discovered, including a recall or reversal request where possible. Record who called, when, the reference number, and what the bank instructed. Do not wait to assemble a perfect insurance file before taking time-sensitive operational steps.

Preserve the original message or portal instruction, full sender information where available, invoice, vendor-master history, bank confirmation, approval log, and any prior legitimate payment instructions. Make a working copy for analysis while protecting originals. If employee access may be compromised, involve the organization’s security and legal contacts under its incident procedure. This guide is not a substitute for their direction.

The email system, accounting platform, bank, and phone records often tell different parts of the story. Build a chronology of when a new instruction arrived, how it was authenticated, who changed the payee record, who approved the transfer, when money moved, and when anyone noticed an anomaly. Note the time zone and source of each timestamp. Do not silently reconcile discrepancies by editing an original record.

For a property-management business, also identify whose funds were affected, which owner or tenant account was involved, and which legal entity initiated the payment. The California Department of Real Estate’s trust-fund guidance can help frame recordkeeping for transactions subject to those rules, but it does not determine insurance or legal responsibility for the event. Keep communications with owners factual and coordinated through the authorized response team.

A criminal may impersonate a contractor and persuade an employee to make an authorized payment, compromise an account and initiate a transfer without authorization, or alter an invoice after a legitimate approval. A duplicate payment to the intended vendor is a different fact pattern. Label the evidence before labeling the coverage: origin of instruction, identity verification, system access, approval authority, destination account, and any deceptive representation.

Commercial-crime and cyber forms may use different definitions for employee theft, computer fraud, funds-transfer fraud, social engineering, voluntary parting, and client property. Ask which provisions, exclusions, sublimits, retentions, and conditions should be evaluated against the documented facts. Do not assume a crime policy necessarily responds just because funds are missing.

Identify every policy that might be relevant for the date the event was discovered and read its notice destination, deadline, discovery wording, and cooperation conditions. Some forms may require early notice before the total loss or root cause is known. Keep copies of the notice, delivery confirmation, carrier reference number, and every subsequent supplement. Avoid representing an initial estimate as a final amount.

If a bank or law-enforcement report is made, retain its reference and the information supplied. The FBI’s business-email-compromise resources explain reporting channels, but the organization should follow its own legal and security procedures as well. A manager may also have contractual notice obligations to an owner; compare those separately from policy notice rather than assuming one notification satisfies both.

Once immediate containment is underway, examine how a changed instruction passed through the workflow. NIST recommends verification through independently known contact details, not a reply to the suspicious request. Test whether the property manager had a verified call-back number, dual approval, restricted vendor-master editing, and reconciliation by someone other than the payment initiator. Record which controls actually operated and which were bypassed.

Use the findings to revise a written procedure and training example, with an owner and completion date. Keep before-and-after versions of the workflow. A control improvement is valuable even if the bank recovers the transfer or a carrier declines a claim, and it can inform accurate answers at the next renewal.

Index the original instruction, invoice and contract, account ownership record, approval chain, transfer confirmation, bank contacts, notices, investigation notes, recovery entries, and final reconciliation. Separate verified facts from hypotheses and record corrections as dated additions. Where personal information is involved, restrict access rather than broadly distributing the file.

This checklist helps a management firm explain what happened and what it did next; it is not a claim determination. The issued policy wording, declarations, endorsements, documented facts, and applicable law control.

• Original instruction and independent verification
• Bank contact and recovery reference
• Policy and owner notice log
• Dated chronology and reconciliation