The Supplier Changed Its Bank Details. Verify the Route Before the Payment.

A supplier’s new bank details can arrive in the most ordinary message of the week: the same invoice format, the same signature, a familiar conversation about a deposit. The useful response is to verify the change through a previously trusted route before updating the payment record. Appearance is an unreliable basis for deciding which requests deserve a check.

That uncertainty is visible in a public accounting discussion. A participant asks what should trigger a callback when a vendor requests new bank details; another worries about a request arriving from the vendor’s genuine account. These are anonymous practitioners’ questions, not verified fraud investigations. They capture the purchasing problem well: waiting for an obvious spelling mistake leaves the process dependent on suspicion.

The familiar email is still only a request

The FBI’s BEC guidance describes both lookalike addresses and access to legitimate billing conversations. It advises verifying changes to account numbers or payment procedures and contacting the financial institution immediately if a fraudulent transfer has occurred. The agency’s examples concern deception; they do not mean every supplier account change is fraudulent.

HSBC’s security guidance makes a particularly useful distinction: a known email address, even with an earlier conversation attached, should not be assumed genuine. Its recommended check is a call to a trusted supplier contact on a number already known, rather than the number printed in the change request.

For the buyer, this means separating the commercial relationship from the proposed beneficiary. You may know the supplier, have received good goods before and owe a genuine invoice. Those facts do not authenticate a newly supplied destination for the money.

Make the callback independent of the change

Start with the supplier contact and telephone number held before the request arrived. If that record is incomplete, establish a trusted route through your company’s approved supplier-verification process. Calling the number in the new bank letter simply allows the request to supply its own witness.

Explain that you are verifying a proposed amendment. Ask the established contact to confirm who authorized it, the effective date and the affected supplier entity. Read back the relevant beneficiary and account identifiers through the approved channel. Record whom you reached, how you obtained the number, when the conversation occurred and what was confirmed. Avoid circulating complete banking details through unnecessary email copies.

A sales representative may know that a change is underway without having authority to instruct payment. Follow the supplier’s established finance route and your own delegated approval rules. If the beneficiary is a different legal entity, treat that as an additional commercial question: why would payment to that entity discharge this particular invoice? Have the appropriate finance or contract owner resolve it. A bank-letter attachment alone does not answer the contractual question.

Keep the amendment separate from the payment run

A practical internal control is to give the change its own record, linked to the supplier master entry and the affected invoices. Preserve the original request, the independent verification and the decision. Have the authorized reviewer approve the amendment before a payment preparer uses it. These are suggested purchasing controls, to adapt to company policy; they are not a universal banking rule.

The record should make five things easy to find: the supplier entity, the previous and proposed instructions, the independent contact route, the verification result and the person authorizing the update. Restrict sensitive account data appropriately. A reviewer needs enough evidence to assess the decision, not an uncontrolled spreadsheet of every vendor’s bank details.

Then check the payment instruction actually selected for the next transaction. A correct master-data amendment is little help if an old payment template remains in use, or if a preparer copies details from another email. The final check should connect the approved beneficiary to the invoice being paid and the bank instruction being released.

When the answer stays unclear

An unanswered callback is an unresolved change, rather than evidence that the request is safe. Explain the verification requirement through the established supplier relationship and escalate the pending payment under your company’s process. Do not let a claimed shipment deadline quietly become permission to bypass approval.

For legitimate changes, consistency helps the relationship: suppliers should encounter the same check rather than an accusation based on a buyer’s intuition. A short verification note also lets another colleague finish the work without reconstructing a private phone conversation.

If money has already gone to an account you suspect is fraudulent, contact your bank immediately through an independently established channel. Follow its response instructions, preserve the messages and transaction records, and use the relevant official reporting route; the FBI identifies IC3 for US BEC reports. Do not wait to complete an internal purchasing review before making that contact. Recovery is not assured.

The decision worth preserving is precise: this authorized supplier contact confirmed this amendment through this independent route, and this reviewer permitted its use. That is a stronger payment record than “the email looked normal.”