How to Verify Vendor Bank-Detail Changes Before Paying an Invoice

Suppliers sometimes change banks, and accounting teams need a dependable way to update payment instructions. A short, consistent verification process helps owners and teams handle those changes together while keeping legitimate supplier payments moving.

The key distinction: approving an invoice and approving its payment destination are separate decisions. A purchase order, delivery record, and invoice may agree while the bank details still need independent verification.

What is a vendor payment-change request?

It is a request to change where or how your business pays a supplier: a new bank account, payment portal, remittance address, or payment method. It may arrive with an invoice or as a separate message. Treat it as a change to the supplier record, rather than an instruction to copy directly into the next payment.

The FBI explains that business email compromise can involve impersonated senders or access to genuine email conversations. An expected invoice or familiar email thread therefore does not establish that new instructions are authentic. The FBI recommends verifying payment changes through independent contact and using a phone number you obtain separately from the request. See its business email compromise guidance.

Which businesses should use this process?

Any business changing supplier payment instructions can benefit. Practical examples include contractors paying material suppliers, agencies paying subcontractors, retailers paying distributors, and property managers coordinating maintenance vendors. The process can be lightweight for a small team and more formal where several people handle purchasing and payments.

Use it whenever payment instructions change, even for a long-standing supplier or a modest invoice. For a new supplier, establish the authorized contact and payment instructions during onboarding so later changes have a trusted starting point.

A six-step workflow your team can adapt

The following is a suggested operating workflow, not a statement that every business must use identical software, staffing, or approval thresholds.

1. Record the request and pause the change. Note the supplier, affected invoices, requested effective date, and person handling the review. Keep the existing supplier record intact until verification is complete. Give the request an explicit status such as “awaiting verification” so it remains visible.
2. Find a trusted contact independently. Start with contact information established before the change request, or independently confirm an appropriate supplier contact. Do not use a replacement phone number or link supplied in the same request as the only verification route. If you cannot establish a reliable contact, keep the change pending.
3. Confirm the change with an authorized supplier representative. Call using that trusted route. Confirm that the supplier requested the change, who authorized it, its effective date, and how the new instructions should be supplied securely. Document the conversation. Do not ask for banking login credentials or one-time security codes.
4. Review and approve the supplier-record update. Where staffing permits, have a second authorized person review the verification evidence and the proposed change. Define who can edit supplier details and who can release payments. For a small team, agree a feasible review arrangement with the owner and accounting provider; do not assume the software supplies these controls automatically.
5. Check the payment separately. Review the invoice, approval, due date, credits, and any relevant receiving evidence. Compare the payment destination against the verified supplier record. Our purchase-order and three-way-matching guide explains the invoice checks; the payment-destination check adds a different layer.
6. Retain the evidence and close the request. Record who verified, approved, updated, and released the payment, with dates and a reference to supporting records. After payment, retain the bank or payment-platform confirmation and resolve discrepancies through the trusted supplier contact.

Nacha’s guidance on business email compromise and vendor impersonation describes independent verification and stronger internal payment controls. A documented review adds evidence to the decision; it does not guarantee that every fraudulent request will be detected.

Worked example: a supplier changes banks before payment day

Illustrative example, not a client result: a landscaping business has an approved $4,800 materials invoice due Friday. On Thursday, an email in the existing conversation asks for payment to a new bank account.

The bookkeeper records the request and holds the account change. The owner calls the supplier’s accounts contact using the number already held in the approved supplier file. If that contact confirms the change and their authority, the team obtains the instructions through its agreed secure process, documents the call, and completes its review before updating the record.

If the contact denies the change or cannot be reached, the team leaves the new instructions unapproved and escalates the request. It coordinates the legitimate invoice’s payment timing through a trusted channel rather than assuming either account is ready to use. An approaching due date is a reason to communicate promptly, not to skip verification.

What should the change log contain?

• Supplier name and internal supplier reference.
• Date received, requested effective date, and affected invoices.
• Verifier, verified contact, callback date, and how that contact was established.
• Approver, approval date, and supplier-record update reference.
• Payment reviewer, payment reference, and resolution status.

Keep full bank instructions in the restricted system used for supplier payments. A general task list can reference that record without copying account numbers into broadly shared notes. Agree access and retention practices with the people responsible for your records and security.

What if the payment has already been sent?

If you suspect a fraudulent transfer, contact your financial institution immediately and ask about urgent recovery steps, including contacting the receiving institution. Report suspected business email compromise to the FBI’s Internet Crime Complaint Center. Preserve the request, correspondence, transaction details, and verification records. Recovery is not assured. Coordinate with your IT support if an account may have been compromised.

Start with one clear owner for the process

Choose who receives change requests, who performs callbacks, who approves updates, and who provides cover when someone is away. Walk through one hypothetical request together before using the process. Ask whether everyone can find the trusted contact and supporting record without searching through multiple inboxes.

A useful first review is simple: can your team explain and evidence the most recent supplier payment change? Build from the controls already working and adjust the handoffs that need clarification. For related support, explore accounts payable and receivable services and the monthly bookkeeping checklist.