How to Verify a Vendor Bank-Account Change Before the Next Payment

The Control Problem

A request to change where a vendor gets paid looks routine. It usually arrives by email, sometimes from an address that looks correct, sometimes even from a compromised real vendor mailbox. Treated as routine, it gets processed the same day. Treated as a control point, it gets frozen and verified first.

This single moment — a payment-instruction change — is one of the most consistently exploited openings in business payment fraud, and it succeeds through impersonation and social engineering rather than through hacking. According to the 2026 AFP Payments Fraud and Control Survey, 74% of U.S. organizations were affected by business email compromise attempts in 2025, and the FBI’s Internet Crime Complaint Center (IC3) reported $3.046 billion in BEC losses across its 2025 Annual Report. Vendor payment-instruction changes are a primary mechanism behind those numbers.

The Recommended Process

1. Freeze. Do not update the vendor record or process the next payment using the new instructions, no matter how the request is worded or how urgent it sounds.
2. Locate a trusted contact. Find the vendor’s phone number from your own records — a prior invoice, your vendor master file, or a signed contract. Never use a number provided in the change request itself.
3. Call and verify verbally. Ask the vendor directly whether they requested the change. Confirm the new account details verbally, digit by digit, rather than by reply email.
4. Get a second person to confirm. Whoever verifies the change should not be the same person who will later approve or release the payment.
5. Document what you did. Record who verified it, how, and when — before the record is updated, not after.
6. Update the record, then pay. Only now should the vendor record change and the payment proceed.

Practical Example

Illustrative example — not a real company. An AP clerk receives an email that appears to be from a long-standing supplier, requesting that future payments go to a new bank account due to a "banking system migration." The email is well-written and references a real, recent invoice number. Following the process above, the clerk locates the supplier’s phone number from a signed contract on file — not the number in the email’s signature block — and calls. The supplier has no knowledge of any banking change. The email is reported internally as a suspected fraud attempt, and no payment is affected.

Common Mistakes

• Calling the phone number included in the request itself, which simply confirms the fraud rather than catching it.
• Treating a reply to the same email thread as verification — if the original account was compromised, the reply goes to the same attacker.
• Allowing "urgent" or "confidential" language in the request to shorten or skip the verification step.
• Having the same person both process the change and approve the next payment, with no independent check in between.

When to Escalate

Escalate to a manager or controller immediately if: the vendor denies making the request, a trusted phone number cannot be located, the request pressures you to bypass your normal process, or a payment has already been sent to a changed account before verification was completed. If a payment has already gone out, see the guidance on responding to suspected payment fraud, and contact your financial institution immediately — acting quickly can improve the chance of recovery, though recovery is never guaranteed.

Sourced from the 2026 AFP Payments Fraud and Control Survey (Association for Financial Professionals) and the FBI Internet Crime Complaint Center (IC3) 2025 Annual Report.

Related Resources

This guide is educational and operational in nature. It is not legal, accounting, or cybersecurity advice, and following it does not guarantee that fraud, error, or loss will not occur.