How the attack usually runs

A convincing message from a supplier or executive requesting a payment change. Technical controls help, but the attack targets process rather than software.

The control that works

Out-of-band verification for any change to payment details, using a number you already had rather than one in the email.