The patient vendor swap
Your client's supplier emails new bank details — pixel-perfect, because the real mailbox was hijacked months ago. PayBeacon holds the change until it's confirmed at the source. The "new bank" was never the supplier's.
Caught — the payment still goes to the real account.
