An email can quote the correct purchase order and sit in a familiar conversation without proving that your Taiwanese supplier authorised a new payment account. The FBI's April 6, 2020 advisory describes attackers reading compromised mailboxes, identifying transactions and impersonating business correspondence to redirect payments.
Before changing the supplier record, establish who approved the new account and whether the supplier intends payment there to settle the named invoice.
Confirm the account outside the email exchange
Use a telephone number already held in reliable records, such as the number used during earlier dealings. A new number in the same email or replacement invoice needs independent verification too. The FBI advisory recommends confirming payment changes in person or through a known telephone number. Taiwan's Criminal Investigation Bureau likewise recommends checking payment requests through existing contact channels, rather than trusting the sender's displayed name.
For a buyer's accounts-payable team, the practical task is to connect the supplier, invoice and intended beneficiary. Ask the established contact to confirm the account name, bank, account number and invoice concerned, and explain any different beneficiary. Record who confirmed the change, when, and through which channel. These are suggested controls, not a statutory checklist or a guarantee that a payment will discharge the debt.
Sending the money does not settle the invoice question
If Taiwan law governs the payment obligation, Civil Code Article 309 provides for discharge when performance conforming to the obligation is received by the creditor or another person entitled to receive it. Article 310 also recognises specified circumstances in which payment to a third party has effect, including the creditor's acknowledgement and, outside the other statutory cases, the extent to which the creditor benefited.
The question therefore cannot be answered from the transfer receipt alone. Nor does identifying a compromised mailbox establish that the buyer or supplier must bear every loss. Before accepting a demand to pay again, have the contract, agreed payment instructions, purported change and confirmation records examined. Whether the invoice was discharged and whether either business has a separate claim require their own assessment; this column does not allocate liability in a particular dispute.
If the money has already left
Contact the sending bank immediately and identify the transfer as suspected fraud. Ask it to request a recall or reversal and explain what documents it needs. IC3's BEC guidance recommends approaching the originating financial institution as soon as the fraud is recognised. A recall request is not confirmation that the money has been frozen or returned. Do not delay that request while the buyer and supplier argue about responsibility.
For a Taiwan criminal complaint or report, Code of Criminal Procedure Article 242 provides for submission in writing or orally to a prosecutor or judicial police officer. Reporting suspected fraud does not itself decide whether the supplier's invoice remains payable under Articles 309 and 310.
IC3 also accepts international complaints, but is a US reporting channel, not Taiwan police. Its FAQ says it does not itself investigate and directs urgent complainants to local law enforcement.
Keep the original message and both invoices
IC3's evidence guidance calls for retaining original documents and prefers electronic email copies, with full headers if printed. As a practical way to preserve that material, export the original or raw email with its headers and attachments using the mail system's export function. Keep it alongside the earlier correspondence. A screenshot is useful for reading the demand, but should not be the only record retained.
Preserve the original invoice and the purported replacement as separate files. Add the purchase contract, earlier payment instructions, transfer confirmation and any record of the verification call. Ask IT personnel to preserve relevant mailbox and access records while addressing any continuing compromise. These are evidence-preservation recommendations, not a prescribed Taiwan filing format.
When preparing a chronology, distinguish what the records show from what someone now suspects. A message's arrival time, a call placed and the bank's response can be recorded precisely. Who controlled the mailbox at that moment may still need investigation. Counsel reviewing a second payment demand needs both sets of information without one being presented as proof of the other.
Sources and review date
Sources opened and checked on October 3, 2026. The 2020 FBI advisory is historical guidance, not a newly reported incident.
- FBI/IC3: cloud-email BEC advisory, April 6, 2020; BEC guidance and FAQ, undated.
- Taiwan Criminal Investigation Bureau: email impersonation and payment verification warning, September 29, 2026.
- Taiwan Ministry of Justice: Civil Code Article 309 and Article 310; Code of Criminal Procedure Article 242, Chinese statutory texts.
This article provides general information and is not legal advice on any individual matter.
