Supplier Bank Details Changed: Verify Before Updating

A request to change a supplier's bank details should trigger independent verification before the payment record changes. A familiar email thread, an invoice with the usual logo, or an urgent message from a senior colleague is not enough. Verify the request through a channel established before the change request arrived.

The FBI's business email compromise guidance recommends secondary-channel verification for account-information changes and rapid contact with the financial institution when fraud is recognized. The workflow here is a defensive control design, not a promise that a particular check eliminates fraud.

Separate the change request from the payment

Treat supplier master-data maintenance and releasing a payment as different decisions. If the same urgent email can both replace the destination account and authorize the transfer, a single compromised conversation can control the whole process.

Create a change record containing the supplier identifier, request time, affected payment methods, and the staff member handling it. Avoid copying full bank details into broad chat channels or ordinary incident updates. Store sensitive financial records only where the authorized team needs them.

Pause affected payments while the change is unresolved under the organization's policy. Explain the pause to the responsible buyer or account owner so that an operational deadline does not silently override the verification step.

Contact the supplier through an established route

Use a phone number or contact path already held in a trusted supplier record or an independently maintained agreement. Do not use only the new phone number in the change email or a link supplied by the requester. That would let the request define its own verification channel.

Ask the established contact to confirm that a change was initiated and to follow the organization's approved validation process. Do not ask them to disclose unnecessary financial data over an insecure channel merely to satisfy an improvised challenge.

If the normal contact is unavailable, follow a documented exception process rather than treating a second email in the same conversation as independence. A process can permit escalation without permitting the requester to nominate the only person who can approve the change.

Review the supplier identity and scope

Confirm which legal entity and contract the request concerns. Large suppliers can have multiple subsidiaries, currencies, or regional payment arrangements. A legitimate change for one entity should not automatically replace details used for every supplier account with a similar name.

Check whether the change affects outstanding invoices, future invoices, or both. Record the effective date and communicate it to the staff who prepare payments. Ambiguity here can cause a genuine request to be applied too broadly or at the wrong time.

Keep any bank-provided account validation in its proper scope. Depending on the service and jurisdiction, it may confirm limited details without proving that the request was authorized by the supplier. Use it as one source of evidence, not a universal identity guarantee.

Require independent review of the update

A second authorized reviewer should compare the approved request with the proposed master-data change before it takes effect. They need access to the evidence, not just a checkbox saying somebody called someone.

Record who verified the request, which established channel was used, when it happened, and who approved the final update. Retain only the necessary evidence and protect it appropriately. Avoid storing secret authentication answers in the audit note.

For a small team without perfect separation of duties, define a compensating control in advance. That could involve owner review through a separate established process. The answer should not be to abandon verification whenever the second staff member is busy.

Verify the payment preparation separately

Before a payment is released, compare its destination with the approved current supplier record and the invoice context. A verified master-data update does not prove that a later manually entered transfer uses the same details.

Keep the final transaction authorization within the normal financial approval workflow. This article does not authorize anyone to send money or bypass a bank's checks. Financial actions remain consequential even after a request has been investigated.

Make exceptions visible. A message saying that a late fee, shipment, or executive deadline requires immediate action is a reason to escalate the decision, not a reason to skip the independent channel.

Respond quickly to a suspected diversion

If a payment may have gone to the wrong destination, contact the financial institution promptly through its known official route and follow the applicable reporting process. Do not promise recovery or wait for a complete internal investigation before seeking time-sensitive help.

Preserve the request and approval evidence, restrict further changes, and review related supplier records. Our mailbox-rule review guide addresses one possible compromise path, but a suspicious request alone does not establish whose account was compromised.

Conclusion

Verify supplier bank changes outside the requesting conversation, document scope and approval, and check payment preparation separately. A trusted process must remain usable under time pressure without allowing urgency to become its only exception.