A supplier bank detail change can arrive just before an invoice is due. The message looks familiar, the amount is expected, and the payment run is closing. If someone updates the account from that email alone, a routine admin task can send company money to the wrong place.
A supplier bank detail change needs its own verification step. The key question is not whether the email looks real. It is whether a person with the right authority confirmed the change through a contact route the business already trusts.
The FBI describes business email compromise as messages that appear to come from a known source and request a legitimate-looking action, including a vendor invoice with changed payment details. Its guidance says to find the company phone number independently, call the supplier, and verify changes to account numbers or payment procedures. The Internet Crime Complaint Center (IC3) also recommends a separate channel or two-factor verification for account-information changes.
Build a control around the change
Keep the control short enough to use during a busy payment run. It should answer four questions: who receives the request, who confirms it, who may change the payment record, and what happens if the confirmation fails.
- Pause the payment update. Do not edit the supplier’s saved bank record from an email, invoice attachment, text message, or phone number supplied in the same request. Keep the invoice in a visible “verification required” state.
- Use a known contact route. Treat the supplier bank detail change as a separate instruction from the invoice itself. Call a number from the supplier record created before the change request, a signed contract, or another independently maintained source. Do not use a number, link, or reply address included in the new message. Ask the supplier contact to confirm the account change and when it should take effect.
- Record the confirmation. Save who confirmed the change, when they did it, which contact route the employee used, and the last four digits or other limited identifier needed to distinguish the new account. Store the record in the approved supplier or finance system. Avoid copying full bank details into general chat or an open task list.
- Separate confirmation from editing. Where staffing allows, one employee confirms the request and another updates the payment record. A second person should compare the saved change with the confirmation record before the first payment goes out. A small team can use an owner or manager for this check.
- Keep a clear exception route. If the known contact cannot be reached, the details do not match, or the request carries unusual urgency, leave the saved account unchanged and hold the affected payment. Give the case to a named manager or finance owner. Do not let an approaching due date turn an unverified change into an approved one.
Make a supplier bank detail change visible
A change that exists only in one employee’s inbox is easy to miss when that person is away. Give each request a case or status in the system the finance team already uses. For example, “received,” “callback pending,” “confirmed,” “record updated,” and “first payment checked” show where the work stands without asking staff to search email threads.
Keep an audit trail that is useful but limited. Record the supplier name and identifier, the date of the request, the person who made the independent callback, the person who changed the record, the approver, and the effective date. Restrict access to the full account number. Set the record retention period under the business’s existing finance and privacy rules.
Access to supplier payment records should follow job responsibilities. Employees who can create suppliers or change their bank details should not automatically have unrestricted authority to release every payment. If the accounting system supports role-based approvals, use them. If it does not, a short documented sign-off can provide a manual checkpoint. Review access when someone changes role or leaves.
Illustrative example
A 12-person design company receives a message asking it to redirect a monthly software invoice. The bookkeeper marks the invoice “verification required” and calls the supplier using the number already stored in the supplier record. The supplier says it did not request a change. The bookkeeper alerts the finance owner, who keeps the existing details, warns the supplier through its established contact route, and checks whether any other payment instruction needs review. This example is hypothetical. It shows a process choice, not a report of a DBG360 client outcome.
Test the process before a real request arrives
Walk through a sample request with the person who runs payments and the person who approves them. Check whether they know which contact record is authoritative, where to record the call, how to place a payment on hold, and who can approve an exception. Test what happens when the main finance employee is on leave.
Review the control after a change to the accounting platform, bank, supplier onboarding process, payment approval limits, or finance provider. A new system can make data transfer faster while leaving an old access rule or approval gap in place. The business owner should confirm that the change record, saved supplier profile, and payment release step still agree.
If a payment has already gone out
Act quickly. IC3 advises a business that discovers a fraudulent transfer to contact its financial institution immediately and request a recall. Keep the original message, payment record, callback notes, and internal incident timeline. Follow the company’s incident process and the reporting instructions that apply in its jurisdiction. Do not promise that a bank can recover the funds.
The FBI’s business email compromise guidance and the IC3 BEC resource explain the threat and verification steps in more detail. This article gives general process guidance. Payment rules, recordkeeping duties, and reporting routes vary by country, bank, and business arrangement, so confirm local requirements with the appropriate adviser.
DBG360 can help map a payment-change workflow, identify where approval or system access is unclear, and agree a proportionate control that fits the team’s size. If a payment process relies on personal inboxes or informal handoffs, book a low-pressure discovery call to discuss where to start.
