Supplier Bank Account Change Verification: Confirm Before You Update

A supplier's email or letter asking you to pay a different account is not verified by that email or letter, or by anything inside the same thread. Confirm the change through a contact you already held or found independently, record who approved it, and only then update the payment master. If the request cannot be verified, hold it and keep paying through the existing instructions or hold the payment. This article covers the verification of a change. It does not cover supplier onboarding, payment schedules, sanctions checks or executing a transfer.

Why the request cannot vouch for itself

The FBI's business email compromise guidance advises verifying any change in account number or payment procedures with the person making the request, and being wary when the requester presses you to act quickly. Its advice is to look up the company's phone number on your own and call to ask whether the request is legitimate. A number supplied by a scammer is not a safe channel.

Other FBI material makes the same point in procurement terms. An FBI field-office release lists red flags that include unexplained urgency, last-minute changes in wire instructions or recipient account information, and communication only by email with a refusal to use the telephone. It advises verifying changes through the contact on file and not through the number provided in the email. A separate FBI advisory on business email compromise tells people to confirm identity by calling a business's main phone line rather than numbers given in the email, and to check that the sending domain matches the business.

The practical rule follows. Anything that arrives with the request, such as a phone number, an email address, a letterhead or a signature, is part of the request. It cannot be the means of checking it.

An illustrative case

This case is invented for illustration and uses no real supplier or bank data. A buyer has an open invoice from "Supplier A." An email arrives from an address that looks right, says the company has changed banks, attaches a letter on letterhead and asks that the next payment go to the new account by the end of the week. The email gives a phone number for questions.

Each element is a reason for caution, not for proof. The letter and the number came from the same message. The address may differ from the real one by a character. The deadline adds pressure. The correct next step is to leave the payment record unchanged and start independent verification.

Build a bank-change verification case

Keep one case record per request. It is a recommended review aid, not a form required by law or by the FBI. Store it where access is restricted, and keep real account details out of general files and emails.

Record where the verification contact came from. A number copied from the request fails that test, and so does one reached by replying to the email.

Run the check outside the request

Use a phone number or an email address you held before the request, such as one in your records from earlier orders or contracts, or find one independently. When you write rather than call, start a new message to an address from your contact list rather than replying to the request, so a spoofed address is not reused. An FBI release on defenses against these scams also recommends setting up a call-back protocol early in the relationship and outside the email environment, and not relying on numbers or addresses embedded in a request.

Ask the supplier's known contact to confirm that the change was requested, what exactly is changing and the effective date. Then follow your own finance procedure. Many buyers require a second person to review changes. That is a buyer policy choice and not an FBI mandate, and it can be sensible for larger payments.

Two checks that sometimes get used as proof are not proof. A bank account that exists, or a routing or SWIFT code that is syntactically valid, shows only that the account is real. A signed letter and a logo show only that someone can produce them. Neither shows the supplier authorized the change. A small test transfer is also not proof of authorization, and the FBI guidance reviewed does not recommend it.

Proceed, hold, or treat as suspected fraud

If the independent contact confirms the change and your approver signs off, update the payment master and file the case. If the contact denies the request, cannot be reached or gives a different answer, hold the change, keep the existing instructions and record the discrepancy.

If a payment has already gone to an account you now doubt, act immediately. The FBI advises contacting your financial institution at once and asking it to contact the institution that received the transfer, then reporting the incident to the Internet Crime Complaint Center at ic3.gov. A recall is a matter for your bank, and speed matters.

For a part from KTSU, send payment-related questions through the contact details you already hold for the supplier and your own finance process. The public excavator undercarriage parts collection identifies the product family. It is not a channel for confirming payment instructions and does not establish any supplier's banking details.

The case is complete when it shows an independently sourced contact, the verified scope of the request, an authorized approver and a dated proceed or hold decision.