Free AP template

Vendor and supplier bank account change verification checklist

A request to change a vendor or supplier bank account is the single most expensive moment in accounts payable. Unverified bank account change requests are the root of most business email compromise (BEC) wire losses, and the request almost always looks routine.

This is a free, copy-and-print checklist your AP team can use to verify a vendor or supplier bank account change and to detect a fraudulent one before you update the master file. It does NOT verify the vendor or the account for you - it is the callback protocol and red-flag list your team runs itself.

Check a specific request Read FAQ

Quick answer

Detection is a callback, not a document

To detect a fraudulent bank account change, call the vendor or supplier on a phone number already in your records - never one from the change request - and confirm the change with two named contacts before you update the master file. A signed PDF is not proof.

Free AP Fraud SOP Kit

Turn this check into an AP policy

Get the vendor bank-change policy, callback script, approval note, incident checklist, and hold triggers for your finance team.

Get the SOP kit Future paid: saved checks, audit log, PDF reports, team templates - $19/mo teaser.

How to detect a fraudulent supplier or vendor bank account change

No single flag proves fraud. Two or more together should stop the change until an independent callback is complete. These are the detection signals AP teams miss most.

  • The bank account change arrives by email only - no phone call and no notice through an established channel.
  • The sender domain is a lookalike (extra or missing letter, .co vs .com, different TLD) or the reply-to address differs from the from address.
  • A new or unfamiliar contact sends the request, even from a correct-looking domain.
  • The request carries urgency: 'effective immediately', 'before this week's run', or 'avoid a service interruption'.
  • The only proof offered is a signed PDF letter on letterhead - which is trivial to forge.
  • The new bank is in a different country or region than the supplier's payment history.
  • The supplier's normal AP contact is copied but never answers your verification attempt.

The bank account change verification checklist (copy or print)

Run every step before you change ACH, wire, routing, IBAN, or account details in the vendor or supplier master. Document each one.

  • 1. Freeze the change. No master-file edit and no payment until verification is complete.
  • 2. Find a trusted phone number - from your existing vendor or supplier master, a prior signed contract, or the supplier's official website - NOT from the change request.
  • 3. Call and confirm the change with a named finance contact, then a second named contact when possible.
  • 4. Confirm the specific new details verbally: account number, routing or IBAN, bank name, and effective date.
  • 5. Require a counter-signed change letter on letterhead, delivered through a channel other than the original email.
  • 6. Get a second internal approver to sign off on the master-file update (dual control).
  • 7. Send a small test payment (for example $1) and confirm receipt with the verified contact before releasing the next full invoice.
  • 8. Record the verification source: caller name, the phone number used and where it came from, date, time, and outcome. Hold payments to that vendor 24-48 hours after any change.

Copy-paste vendor and supplier callback script

Use this on the trusted-number call, then file it with the vendor record. Adapt the bracketed fields.

  • Hi, this is [name] from [company] accounts payable. I am calling on the number already in our records, not the one in the request.
  • We received a request to change the bank account for [supplier] on invoice or payment [number] for [amount].
  • Can you confirm the change, the new account and routing or IBAN, and the effective date?
  • Who authorized it, and can a second known contact confirm? For security we will not use any contact details from the request itself.

Turn the checklist into a one-page AP policy

A control only works when it is the same every time. Make this the standing rule for any payment-detail change.

  • Adopt 'no bank account change without a callback on a trusted number' as written policy.
  • Require dual approval for every master-file payment change, with no exception for urgency.
  • Store the completed checklist with the vendor record as your audit trail.
  • Get the full AP Fraud SOP Kit for the policy, callback script, approval note, and incident checklist in one workflow.

If a fraudulent bank account change already went through

Wire-recall windows close within 24-72 hours. Move the same day.

  • Call your bank immediately and request a wire recall under the FBI Financial Fraud Kill Chain.
  • File a complaint with the FBI IC3 (ic3.gov) the same day and report to the FTC (reportfraud.ftc.gov).
  • Notify the impersonated vendor or supplier so they can warn other customers and check their own email security.
  • Have IT check whether AP or supplier mailboxes were compromised, and engage cyber insurance and legal counsel.

Disclaimer

ScamSpot for Business provides risk indicators and control templates only. It does NOT verify vendors, suppliers, bank accounts, or invoice legitimacy. Always call the vendor or supplier on an independently-verified phone number - never one in the request - before updating master data.

  • Not a vendor or supplier verification service.
  • Not a bank-account ownership validator.
  • Not legal, financial, or compliance advice.
  • Report confirmed fraud to the FBI IC3 (ic3.gov) and the FTC (reportfraud.ftc.gov).

Example: supplier bank account change BEC

Input

Per our finance director, we have moved banking effective immediately - please update our payment file with the new account in the attached letter and pay this week's invoices to it.

What to notice

  • Email-only change plus same-day urgency plus PDF-only proof is a classic BEC bank-change pattern.
  • Detect it with a callback to the supplier on a number from your records, confirmed by two contacts.
  • Send a $1 test payment and get dual approval before releasing the full invoice.

Bank account change verification FAQ

How do you detect a fraudulent supplier bank account change?

Call the supplier on a phone number from your own records - never one in the request - and confirm the new account with two named contacts. Treat email-only requests, urgency, lookalike domains, reply-to mismatches, and PDF-only proof as detection signals that require a callback before any change.

What is the single best control against vendor bank account change fraud?

A callback on a trusted phone number before you update the master file. That one step stops the majority of vendor bank-change BEC, even when a signed letter or a correct-looking email is provided.

Is a signed PDF letter on letterhead enough to change a bank account?

No. PDFs and signatures are easy to forge. Treat the letter as one document among several and verify by phone on a known number before changing anything.

Is the process different for a vendor versus a supplier bank change?

No. Whether you call it a vendor or a supplier, the control is identical: freeze the change, call back on a trusted number, confirm with two contacts, require dual approval, and send a test payment before the full amount.

Does ScamSpot verify the vendor or the new bank account?

No. ScamSpot for Business provides risk indicators and control templates only. It does not verify vendors, suppliers, bank accounts, or invoice legitimacy. Always verify by phone on an independently-sourced number before updating master data.