When a Supplier Changes Bank Details, Pause Before Paying

It is late Friday, the supplier invoice is due, and a message arrives saying the company has switched banks. The sender knows the order number and uses a familiar signature. The easiest move is to update the payment record and get on with the day. That is also the moment to slow down.

A request to change where money goes deserves its own check, even when it appears inside a normal conversation. Business email compromise scams can involve messages that look like they came from a vendor or another trusted contact. The FBI's Internet Crime Complaint Center (IC3) advises businesses to confirm account changes through a separate channel. For a small shop, that does not need to become a complicated security program. A clear pause-and-check routine is a good start.

Make a change request wait

Decide in advance that no one updates supplier payment details based only on an email, text, or new invoice. Put the rule where the people who handle bills can find it. If one person pays suppliers, that person needs to know what to do. If a bookkeeper or manager shares the work, agree on the same steps so a request cannot slip through during a handoff.

A useful rule is simple: a change to bank details is unconfirmed until someone checks it using contact information already on file. That means a phone number from a signed agreement, a previous verified invoice, or the supplier record your business has used before. Do not use a new number, link, or reply address supplied in the change request. If a message says the old contact is unavailable, wait until you can reach the supplier through another known route.

This can feel awkward when the person asking sounds familiar. It helps to make verification a routine rather than a personal accusation. You are not saying the supplier is dishonest. You are following the same payment check every time details change.

Use a second channel, not a second email

Replying to the message does not independently confirm it. If someone has access to the email account or has copied an active thread, they may be able to answer convincingly. Instead, start a fresh call or use a known supplier portal if your business already has one. Ask the supplier to confirm that the payment destination has changed and when the change should take effect.

Keep the question narrow. You can say, 'We received a request to change your payment details. Before we update our records, can you confirm the change through our usual contact?' There is no need to read a complete bank account number aloud to an unexpected caller. Follow the verification process you have agreed with the supplier, and share sensitive details only when the process calls for it.

If the contact does not confirm the change, do not send money to the new account. If you cannot reach them, leave the existing record untouched and ask the supplier to reconnect through the established channel. A deadline in the message does not make the new instructions safer.

Give unusual changes an extra pair of eyes

For a one-person business, the second check may be a quick call to the supplier followed by a note in the invoice record. In a shop with a manager or bookkeeper, ask another authorized person to review changes before the first payment goes to the new destination. A second person should see the request and the confirmation, not merely click an approval button.

Set a limit that makes sense for your operation. You might require a second approval for every new supplier account, or only for larger payments and urgent changes. The exact threshold is a business decision. The important part is to write it down and apply it consistently, including when the owner is busy or away.

Urgency, secrecy, a last-minute request, or a change in how the supplier communicates are reasons to verify more carefully. They do not prove a message is fraudulent, but they are poor reasons to skip the check. A legitimate supplier should be able to confirm payment instructions through a channel you already trust.

Keep a small record of the decision

After confirmation, record who verified the change, which known contact method they used, the date, and who approved the update. Save the confirmed instructions in the supplier's normal record, then update the payment details there. Avoid leaving the only copy in a personal inbox or a sticky note beside the register.

This note is not paperwork for its own sake. It helps the next person answer ordinary questions: Was the account change checked? Who spoke with the supplier? Which payment details are current? If an invoice is disputed later, a short record is much easier to follow than a string of forwarded messages.

Review supplier records when there is a natural reason, such as a routine account review or a staff handoff. You do not need to call every supplier every week. Just make sure the people who can change payment records are known, and that old access is removed when someone no longer handles that work.

If money has already gone to the wrong place

Act quickly. Contact your bank or payment provider using its established phone number and explain that a transfer may be fraudulent. Ask whether it can stop, recall, or otherwise respond to the payment. Preserve the messages, invoice, account-change request, and call notes. Tell the supplier through a known contact method, and report the incident through the appropriate channels.

The IC3 guidance on business email compromise also recommends contacting the originating financial institution as soon as fraud is recognized and filing a detailed complaint. Do not wait to assemble a perfect packet before calling the bank. The first useful step is getting the issue in front of the people who may be able to help.

A small routine beats a rushed exception

Write down who may update supplier payment details, which existing contact source counts as trusted, and when another person must approve the change. Keep the rule close to the invoice workflow. Then rehearse it once with the person who covers payments when you are away.

The next urgent email may be genuine. A quick independent confirmation lets you pay with more confidence either way. The supplier gets their money, your records stay tidy, and Friday can get back to being about Friday.