A supplier emails to say their bank account has changed. The message uses their usual signature, refers to a genuine invoice and arrives during a busy payment run. Nothing about the spelling looks suspicious. Should your accounts team make the change?
Treat the request as a payment-control decision. A convincing message may come from an impersonator or from a genuine account that an attacker has accessed. Your process needs to work even when the email looks completely normal.
Agree one route for changes
Write down who can request, verify and approve supplier bank details. Keep the process short enough for people to follow during a busy week. It should apply to established suppliers as well as new ones, and to changes requested by directors.
Choose a trusted contact number already held in your supplier records. Call that contact independently and confirm the account name, sort code, account number and reason for the change. A number included in the change request has not yet been verified. If the usual contact is unavailable, pause the change and escalate it internally.
Separate checking from payment approval
For significant payments, involve a second authorised person. The first person records the independent verification; the second checks that evidence before releasing payment. Agree a proportionate approval threshold with the person responsible for your finances.
- Record who verified the request, when and through which trusted channel.
- Keep the original request and the approval record together.
- Check the payment amount and destination immediately before authorisation.
- Make exceptions visible to a named manager rather than quietly bypassing the process.
Banking checks can provide useful additional information, but a successful check should not replace your own approval process. Discuss the checks available through your bank with your finance team.
Make it easy to stop the payment run
Staff need permission to question urgent requests. A director asking for a favour, a supplier threatening late-payment charges or a message marked confidential should not remove the verification step.
Practise the conversation: “We verify every bank-detail change using the contact details already in our records.” That makes the check a routine business rule rather than an accusation against the person making the request. Include temporary finance cover and outsourced bookkeepers in the same process.
If a payment may already be fraudulent
Contact your bank immediately using its official contact details and tell your IT support contact. Preserve the messages and explain what was changed and when. Your IT team can investigate whether an account has been accessed and help contain further activity. Follow the current official incident-reporting route for your location.
Do not ask the employee to solve the incident alone. A quick, factual report gives the business a better starting point than a search for someone to blame.
Turn the rule into a habit
Review a sample of recent supplier changes and check whether the evidence exists. An incomplete record is a chance to improve the process before the next payment run.
39Support can help review the email security, account protection and staff awareness around your payment process. Book a free 60-minute IT review and bring one anonymised example of how your team currently handles a bank-detail change.