Letter from the table: The payment I could not call back

Letter from the table

RC/FP/2026/T.5 · 31 August 2026

To the members of the Fair Play Council,

I support the Business Fraud Standard. I support it because I have lived through the space between noticing a payment was false and finding out that nobody could promise to bring it back.

On 10 March 2026, I received an invoice from a supplier we had worked with before. The amount was MXN 184,600. Two days later, an email in the same conversation said the supplier’s bank details had changed. It looked ordinary: the message referred to the invoice and the work already discussed. I did not call the number on the new message. I made the transfer on 17 March through SPEI from our business account to the account listed on the revised invoice.

I am responsible for authorising payments. I am not writing this to suggest that responsibility belongs somewhere else. I am writing because a payment process should not make a person’s one mistake final before anyone has a meaningful chance to check it.

On 19 March, when I contacted the supplier using the telephone number we already had, they said they had not changed their account details and had not received the money. The email account or conversation had been interfered with; the message I had trusted was not a genuine instruction from them. I called my bank at once, then went to a branch with the invoice, the email thread and the SPEI transfer details. I asked the bank to recall the payment and contact the receiving institution. I obtained a case number and sent the documents they requested.

Mexico’s SPEI is a fast payment system, not a card payment with a simple cancellation button after authorisation. I used Banco de México’s electronic payment receipt service to check the transfer record. That helped me confirm the payment details; it did not tell me who controlled the receiving account or return the money. My bank could make a request to the receiving institution, but I was not given a guaranteed recovery route. I also asked what formal complaint options were available. I understood that CONDUSEF could be a channel for a financial-services complaint, but that process was not an immediate way to retrieve funds already transferred.

I followed up repeatedly, provided the documents again when asked, and made a report to the relevant authorities. I also had to tell the real supplier that its invoice remained unpaid. By 31 August, none of the MXN 184,600 had come back. The supplier and I agreed on a later payment arrangement, but the original loss did not disappear because I had made a report.

The cost was not only the transfer. For several weeks I had to decide which obligations could wait. I moved MXN 29,000 from personal savings I had kept aside for my household. I used short-term credit to cover part of the gap; by the end of June, its fees and interest had cost MXN 7,360. We delayed some planned expenses and paid the people on our small team two days later than usual. I had to explain the delay without making them carry the uncertainty I was feeling. Even after the immediate pressure eased, I spent time assembling records and following up instead of doing ordinary work.

What would change the outcome is not a promise that every disputed transfer can be reversed. It is a system with several safeguards, and a duty to act quickly when a customer reports a credible fraud. Before a payment is authorised, the sending provider should show whether the payee name matches the account and make a mismatch difficult to overlook. If a business reports an authorised push payment or business email compromise, the sending provider should be able to start a standardised recall immediately, preserve the evidence and contact the

receiving provider without making the customer discover the right department by trial and error.

The receiving provider should respond promptly and take proportionate steps to prevent funds that may be connected to fraud from being moved while the report is assessed. Where a small business has acted on a fraudulent instruction and meets a clear evidence standard, reimbursement should be available under defined rules. The process should say who is responsible, what information is needed and when a decision will be made. It should cover cross-border payments too; a fraud does not become less damaging because the receiving account is in another country.

There must be room to examine the facts and to reject claims that do not meet the standard. But a customer who authorised a transfer because a criminal substituted payment instructions should not be left with no practical remedy simply because the payment was technically authorised. Verification, a rapid recall process and fair reimbursement are not competing ideas. Together, they give banks and payment providers a reason to prevent harm, a way to limit it when it happens, and a fair rule for sharing the loss when prevention fails.