Supplier bank details have changed: build verification into the payment workflow

A payment can settle the correct invoice for the correct amount and still go to the wrong recipient. That is what makes supplier bank-detail fraud particularly dangerous for wholesalers: matching the purchase order, receipt and invoice does not establish that a new beneficiary account belongs to the supplier.

The control belongs in supplier-account maintenance. Bank-detail changes should enter a defined verification and approval workflow before the new account can be used for payment. The next payment run then uses approved data, rather than asking a payment operator to investigate an email under deadline pressure.

A familiar email address is only part of the evidence

Fraudulent instructions can arrive from an imitation address or a genuinely compromised mailbox. The FBI's business email compromise guidance describes attacks that exploit legitimate correspondence and specifically recommends verifying changes in account numbers and payment procedures. A recognisable signature, accurate invoice number or familiar conversation thread does not establish that the request is authorised.

The UK National Cyber Security Centre similarly recommends verifying important email requests through another communication method. For supplier-account changes, the useful application is independent contact with an authorised supplier representative using contact details already verified or obtained independently of the change request.

A phone number written in the new email is part of that request. Calling it may simply move the conversation to the person who sent the fraudulent instructions. The verification process must establish both the contact's identity and their authority to confirm the amendment.

Separate the request, verification and approval

Record the supplier account, existing beneficiary details, proposed replacement, reason for the change and effective date. Retain the original request in the controlled record. A change of bank, account holder or payment country may require different supporting evidence under the company's supplier policy.

The verifier confirms the request through the independent contact route and records who was contacted, when and what was confirmed. Bank letters or account statements can support the record, but documents received through the same unverified channel do not independently authenticate the request.

A separate authorised approver then reviews the evidence before the amendment becomes available for payments. Access rights should reflect those responsibilities. A second approval adds limited protection if it consists only of rereading the same email without checking the verification record.

Connect the amendment to payments already prepared

The effective date matters when payment files or scheduled transfers already exist. The procedure should identify whether they use the old details and whether any must be withdrawn and regenerated through the normal approval process. An approved supplier-master change does not necessarily alter a file previously exported to the bank.

Consider a hypothetical change approved on Tuesday, with a payment file prepared on Monday for Wednesday settlement. Finance needs to establish which beneficiary that file contains. The amendment record and the payment authorisation should make the answer traceable.

The same applies to duplicate supplier accounts, overseas branches and payments to an appointed factor. These may be legitimate arrangements, but the relevant entity and authority need to be verified. Their unusual structure should trigger the appropriate established checks rather than an improvised workaround.

Define the response to an unverified or suspicious change

An unverified amendment remains pending and cannot supply new payment instructions. Finance contacts the supplier through the established route to agree how affected invoices will be handled. Neither reverting to the previous account nor accepting the new one should be assumed safe without understanding why the change was requested.

If a fraudulent transfer may already have been made, contact the paying bank immediately and follow the organisation's incident-reporting procedure. Preserve the correspondence, amendment history and payment references. The FBI also emphasises immediate contact with the financial institution when business email compromise is suspected.

A good control leaves a straightforward record: a legitimate request, independent verification, authorised amendment and payment to the approved beneficiary. That sequence protects a routine supplier payment without turning each payment run into a fresh investigation.