How to Verify Vendor Bank Detail Changes Before Payment

By Taylor Frizzell. Updated November 4, 2026. Worked examples are fictional.

Why a familiar email is not enough

A genuine-looking invoice or signed bank letter can carry false payment instructions. A message may come from an impersonated address or a compromised account. The FBI’s BEC guidance recommends independently obtaining contact details and verifying payment changes. Treat urgency as a reason to use the procedure carefully.

A practical seven-step verification workflow

1. Register the request. Assign a change ID and record the supplier ID, requester, date, payment affected and evidence location. Keep full account details in restricted storage.
2. Pause the update. Keep unverified instructions out of the approved vendor master. Route any urgent due-date issue to the designated manager.
3. Choose an independent contact. Use a previously verified supplier record or another independently validated source. Do not use a replacement number provided solely in the request.
4. Confirm authority and change. Reach an authorized supplier representative. Verify that the supplier initiated the request, the effective date and the intended beneficiary. Do not exchange passwords or security codes.
5. Obtain separate approval. A second authorized person reviews the request and verification evidence. Resolve conflicts before updating the record.
6. Control the actual update. An authorized user enters the approved change. Another reviewer compares the system record with the verified instructions and checks the audit log.
7. Review the first payment. Confirm that the final payment file uses the approved destination, amount and beneficiary. Reconcile the resulting payment and retain evidence.

This workflow is an editorial control example. Adapt the roles, bank validation services and payment holds to your organization. A valid routing number or small test payment alone does not establish who controls an account.

A callback script using fictional details

Do not read confidential payment information to an unverified caller. If the authorized representative cannot be reached, escalate the hold rather than accepting a substitute contact from the same suspicious message.

What the verification record should contain

Fictional example: an urgent Friday request

A vendor asks Desert Office Services to redirect a $7,200 payment due that afternoon. The email includes a new phone number and bank letter. The bookkeeper logs the request but does not update the vendor. The owner calls the established switchboard, reaches the supplier’s finance manager and learns that no change was requested.

The team preserves the message and follows its security escalation procedure. They separately verify the genuine invoice and approved destination before deciding whether to pay. The issue is the proposed destination, not automatic proof that the underlying invoice is invalid.

If payment has already been sent

Contact the financial institution immediately using its established official channel and request assistance with the suspected misdirected payment. Preserve transaction references and relevant communication. The FBI directs BEC victims to report through IC3. Follow internal incident response procedures and involve authorized advisers. A recall request does not guarantee recovery.

Common mistakes

• Replying to the change email as the only verification.
• Trusting a logo, signature, bank letter or familiar voice without independent checks.
• Approving the invoice while overlooking the changed beneficiary.
• Letting the person who changed the record independently release the funds.
• Leaving sensitive banking details in an unrestricted review spreadsheet.

Frequently asked questions

Use the wider control framework

Read Accounts Payable Fraud Detection: Red Flags and Controls and download the payment approval checklist. Supplier changes belong in a governed vendor master with clear owners, permissions and change records.