A request to change a supplier’s bank details can look routine, especially when it arrives in an ongoing email conversation. But an email account or message thread may have been impersonated or compromised. Before changing payment instructions, staff should verify a supplier bank detail change through a contact method independent of the request, then have another authorized person review and approve the change.
This process helps distinguish a genuine supplier request from business email compromise, a type of fraud in which criminals impersonate or compromise business email accounts to influence payments. The FBI’s Business Email Compromise guidance describes the threat and provides information for businesses.
A stop-and-verify process for supplier bank changes
1. Pause the change and hold the payment
Do not edit the supplier’s payment record or release a payment based only on an email, invoice, text, or voicemail requesting new bank details. Put the change on hold while it is checked. If a payment is already queued, follow your organization’s process for pausing it until verification and approval are complete.
Urgency is not a reason to skip a control. A message that pressures staff to act quickly, keep the request confidential, or bypass the usual approval path should make them more cautious.
2. Find a trusted contact independently
Use a supplier contact number already stored in a trusted vendor record or another contact source your business established before the request arrived. If that information is missing or may be out of date, find a contact through a source independent of the change request and confirm that it belongs to the supplier.
Do not use a phone number, link, reply address, or contact details included in the change message. Do not rely on a phone number in an attached invoice or on the sender’s email signature. Those details could be controlled by the person making the fraudulent request. Caller ID alone is not proof of identity.
3. Call and confirm the request
Call the independently verified contact using your organization’s normal procedure. Ask whether the supplier requested a bank-detail change and confirm the relevant information before updating the vendor record. If your internal policy permits it, confirm only the information needed to identify the proposed change, and avoid sending sensitive payment details through an unprotected email exchange.
If the person reached cannot confirm the request, seems unfamiliar with it, or provides details that do not match, stop. Do not treat a follow-up email from the same thread as independent confirmation.
4. Keep verification and approval separate
The employee who makes the callback should document what happened, but should not be the only person deciding that the change is approved. A second authorized employee should review the verification record and approve the supplier-record change or the payment, according to your organization’s controls.
This separation makes it less likely that a mistaken or fraudulent request will move directly from an inbox into a payment. It also gives the approver a chance to spot missing information, mismatched details, or an exception that needs escalation.
5. Update records only after approval
Once the callback is complete and the second approver has reviewed the evidence, an authorized employee can update the supplier’s payment instructions through the organization’s approved process. Restrict access to vendor payment records to staff who need it, and preserve a record of who made and approved the change.
For broader email protections, see Zevonix’s article on managed email security gateways. Email security can support a safer process, but it does not replace independently verifying a payment change.
What to record after the callback
Keep a concise record that lets another authorized person understand what was checked and why the change was approved. Include:
- The date and time of the verification.
- The contact method and the trusted source used to find the phone number.
- The name and role of the person reached, and the supplier they represented.
- Whether the supplier confirmed the request and which payment details were verified.
- The employee who made the callback and the result of the check.
- The second approver and the date the change or payment was approved.
Follow your organization’s data-handling rules when recording bank information. Avoid placing full account details in notes or logs that are broadly accessible when a secure, approved vendor-record system is available.
If you cannot verify the request
If the known contact cannot be reached, keep the existing payment instructions in place and escalate the request to the appropriate manager or finance contact. Ask the supplier to reconnect through an established channel, but do not use the contact information in the original change request as a shortcut. Resume the change only after independent confirmation and the required approval.
If the request is urgent, explain that your organization requires an independent confirmation before changing payment details. A legitimate supplier should be able to work through a reasonable verification process. Do not make an exception simply to meet a deadline.
If money has already been sent
Contact your financial institution immediately and explain that the payment may have gone to a fraudulent account. Ask what steps are available to stop, recall, or trace the transfer. Notify the appropriate internal finance, security, or management contacts, preserve the original messages and payment records, and follow your organization’s incident-response process.
Use a trusted channel to contact the supplier and confirm what happened. The FBI’s BEC guidance includes information about reporting this type of fraud. Keep the response focused on acting quickly and preserving relevant records.
Frequently asked questions
Should we accept bank-detail changes sent by email?
Treat an email as a notification, not as proof that the request is genuine. Independently call a trusted supplier contact and complete your approval process before updating payment instructions.
Which phone number should staff use?
Use a number from a trusted vendor record or another source established independently of the change request. Do not call a number supplied in the email, invoice, or message asking for the change.
Should someone else approve the payment?
Yes. Have a second authorized person review the verification record and approve the change or payment. Keep the person who performs the callback separate from the person who gives final approval.
What if the supplier’s known contact cannot be reached?
Keep the existing payment instructions, pause the change, and escalate internally. Wait until the supplier’s request can be confirmed through a trusted, independent contact method.
What if the payment has already been sent?
Contact your financial institution immediately, alert the appropriate internal contacts, preserve the relevant communications and payment records, and follow your incident-response process.
Make verification a routine payment control
A reliable supplier bank account change verification process has a clear sequence: pause, independently contact the supplier, document the confirmation, and obtain a separate approval. Make sure staff know where trusted contact information is kept and who can approve changes. If you want help reviewing your organization’s security practices, Zevonix offers a free security assessment. You can call (904) 658-0777 to get started.