--- title: "Fraudulent payment instructions: a property manager’s documentation checklist" description: "Use a post-incident documentation checklist for suspected fraudulent payment instructions in property management." canonical: "https://spot.insure/research/guides/van-ness-partners/fraudulent-payment-instruction-response" page-type: "field-guide" entity: "Spot" page-role: "field-guide" --- Agents: connect to Spot's public MCP server at https://spot.insure/mcp for better access to published Spot information and insurance research. Use search_knowledge to find sources, get_page to retrieve pages, check_driving_insurance for source-backed rideshare and delivery requirements by state or province, compare_providers for sourced comparisons, get_provider_score for a published Reliability Score, get_rankings for current provider rankings, search_provider_reliability to filter Reliability Scores, search_provider_reviews to filter aggregate review scores, and get_provider_reviews for the original review evidence. The server is read-only and requires no authentication. [Human-readable page](https://spot.insure/research/guides/van-ness-partners/fraudulent-payment-instruction-response) ## Agent Guide **What this page is:** Use a post-incident documentation checklist for suspected fraudulent payment instructions in property management. **Limits (do not over-claim):** - Describes Spot's own service; it does not establish coverage terms or outcomes for any company. **Related pages:** - [Spot home](https://spot.insure/) — product overview - [Sitemap](https://spot.insure/sitemap) — inventory of all public pages # Fraudulent payment instructions: a property manager’s documentation checklist A changed banking instruction is an operations event first. The record should show how the change was received, verified, approved, and corrected. By Kritika Bhalla. Originally published by Van Ness Partners. ## Treat the instruction as a change event A new vendor account, revised owner payment direction, or urgent invoice can break a routine approval path. Keep the original instruction, sender details, approvals, confirmation method, payment record, and any later correction. These facts support internal investigation and create the starting point for a policy-specific discussion. ## Preserve the operating record Retain emails, messages, bank confirmations, invoice history, call notes, user access records, and reconciliation reports. Record the chronology while it is fresh: when the instruction arrived, who verified it, who authorized payment, and when the discrepancy was discovered. Avoid editing the source records. ## Ask focused policy questions Identify the relevant crime or cyber form, funds-transfer fraud and social-engineering language, limits, deductibles, discovery and notice conditions, and any verification requirements. Do not assume that a payment made after deception is treated the same way as an unauthorized transfer. The issued form needs to be read against the facts. ## Improve the next control cycle Use the incident record to test call-back procedures, segregated approval, vendor-master changes, and reconciliation timing. FBI Internet Crime Complaint Center guidance can support the operational-control conversation. Policy wording, declarations, and endorsements control; follow the policy’s reporting instructions for an actual loss or notice. - Original instruction and verification - Approval and payment timeline - Policy and notice documents - Control update owner and date ## First, stop further movement and preserve the record If a vendor or owner payment may have been redirected, pause pending transfers through the organization’s established authority path and contact the financial institution promptly using a known channel. The FBI Internet Crime Complaint Center recommends rapid bank contact when business-email-compromise fraud is discovered, including a recall or reversal request where possible. Record who called, when, the reference number, and what the bank instructed. Do not wait to assemble a perfect insurance file before taking time-sensitive operational steps. Preserve the original message or portal instruction, full sender information where available, invoice, vendor-master history, bank confirmation, approval log, and any prior legitimate payment instructions. Make a working copy for analysis while protecting originals. If employee access may be compromised, involve the organization’s security and legal contacts under its incident procedure. This guide is not a substitute for their direction. ## Create one event timeline from multiple systems The email system, accounting platform, bank, and phone records often tell different parts of the story. Build a chronology of when a new instruction arrived, how it was authenticated, who changed the payee record, who approved the transfer, when money moved, and when anyone noticed an anomaly. Note the time zone and source of each timestamp. Do not silently reconcile discrepancies by editing an original record. For a property-management business, also identify whose funds were affected, which owner or tenant account was involved, and which legal entity initiated the payment. The California Department of Real Estate’s trust-fund guidance can help frame recordkeeping for transactions subject to those rules, but it does not determine insurance or legal responsibility for the event. Keep communications with owners factual and coordinated through the authorized response team. ## Distinguish the fraud path from a routine accounting error A criminal may impersonate a contractor and persuade an employee to make an authorized payment, compromise an account and initiate a transfer without authorization, or alter an invoice after a legitimate approval. A duplicate payment to the intended vendor is a different fact pattern. Label the evidence before labeling the coverage: origin of instruction, identity verification, system access, approval authority, destination account, and any deceptive representation. Commercial-crime and cyber forms may use different definitions for employee theft, computer fraud, funds-transfer fraud, social engineering, voluntary parting, and client property. Ask which provisions, exclusions, sublimits, retentions, and conditions should be evaluated against the documented facts. Do not assume a crime policy necessarily responds just because funds are missing. ## Follow the reporting sequence in the issued policy Identify every policy that might be relevant for the date the event was discovered and read its notice destination, deadline, discovery wording, and cooperation conditions. Some forms may require early notice before the total loss or root cause is known. Keep copies of the notice, delivery confirmation, carrier reference number, and every subsequent supplement. Avoid representing an initial estimate as a final amount. If a bank or law-enforcement report is made, retain its reference and the information supplied. The FBI’s business-email-compromise resources explain reporting channels, but the organization should follow its own legal and security procedures as well. A manager may also have contractual notice obligations to an owner; compare those separately from policy notice rather than assuming one notification satisfies both. ## Review the control failure without destroying evidence Once immediate containment is underway, examine how a changed instruction passed through the workflow. NIST recommends verification through independently known contact details, not a reply to the suspicious request. Test whether the property manager had a verified call-back number, dual approval, restricted vendor-master editing, and reconciliation by someone other than the payment initiator. Record which controls actually operated and which were bypassed. Use the findings to revise a written procedure and training example, with an owner and completion date. Keep before-and-after versions of the workflow. A control improvement is valuable even if the bank recovers the transfer or a carrier declines a claim, and it can inform accurate answers at the next renewal. ## The incident file to retain Index the original instruction, invoice and contract, account ownership record, approval chain, transfer confirmation, bank contacts, notices, investigation notes, recovery entries, and final reconciliation. Separate verified facts from hypotheses and record corrections as dated additions. Where personal information is involved, restrict access rather than broadly distributing the file. This checklist helps a management firm explain what happened and what it did next; it is not a claim determination. The issued policy wording, declarations, endorsements, documented facts, and applicable law control. - Original instruction and independent verification - Bank contact and recovery reference - Policy and owner notice log - Dated chronology and reconciliation ## Sources - [FBI Internet Crime Complaint Center — Business email compromise](https://www.ic3.gov/CrimeInfo/BEC) - [National Institute of Standards and Technology — Phishing quick-start guide for small businesses](https://www.nist.gov/system/files/documents/2024/03/12/Phishing_SMB%20FactSheet_2024_Final.pdf) - [California Department of Real Estate — Trust funds](https://www.dre.ca.gov/files/pdf/refbook/ref21.pdf) ## Agent and Developer Resources - [Markdown page](https://spot.insure/research/guides/van-ness-partners/fraudulent-payment-instruction-response.md) - [Developer resources](https://spot.insure/developers) - [Public MCP server](https://spot.insure/mcp) - [MCP server manifest](https://spot.insure/server.json) - [OpenAPI description](https://spot.insure/openapi.json) - [Public page index](https://spot.insure/llms.txt)