Vendor Bank-Detail Changes: A Verification Checklist

When a supplier asks you to change its bank details, verify the request through an independently established contact route before updating the vendor record or releasing an affected payment. Confirm the exact proposed change, record who authorized it, and check what was actually saved. Any unanswered question needs an explicit hold and an accountable finance owner.

A familiar sender or an existing invoice thread is insufficient evidence. The FBI’s business email compromise guidance describes both impersonation and access to legitimate billing conversations. It recommends independently looking up a company’s telephone number and verifying changes to payment procedures. The operational task is to turn that advice into a repeatable decision before money moves.

This vendor bank detail change verification checklist is for accounts-payable staff, business owners and the people who maintain supplier records. It provides an original operating framework, not a bank’s procedure, a legal standard or a guarantee against fraud. Use it with your organization’s authorized finance controls.

Give the request an owner and a visible hold state

Create a change record when the request arrives, even if it appears routine. Connect it to the supplier’s existing identifier and the affected invoices or payment batch. Record the arrival time, channel, claimed requester and person responsible for the review. Preserve the original message in the organization’s appropriate restricted evidence location.

Keep the requested information separate from the currently approved vendor data. A proposed destination should not become the working default while verification is unfinished. Ask the finance owner how to hold the affected change and payment in the actual system. An informal note in someone’s inbox is difficult for the next person to discover.

Define what the hold covers. It may concern a particular invoice, payment instruction or vendor-record change; it should not silently expand into a stop on every unrelated supplier payment. Equally, do not automatically pay the old account because it is already on file. The supplier may genuinely have changed banks. The destination for the affected payment still needs an authorized decision.

Identify the backup reviewer before the regular owner is unavailable. A message that says “urgent, the usual approver is away” should reach a defined escalation route. It should not create a new approval method in the middle of the request. Record unresolved requests as held, with the next action and person responsible.

Verify through a contact route independent of the request

Start with a contact established through the existing supplier relationship, rather than a number added to the new invoice, email signature or attachment. Record where the contact information came from. If you have no reliable existing route, establish one through your organization’s approved supplier-verification process and leave the requested change pending.

The NCUA’s guidance on business email compromise recommends verifying payment changes in person or through a known telephone number. Its wire-fraud discussion also identifies separation of duties, dual controls and callback parameters. That guidance addresses credit unions; the workflow here adapts those principles for a business team rather than claiming every company has the same regulatory duties.

Make the contact purposeful. Establish who can speak for the supplier about the banking change, which supplier entity is involved, and which invoices or effective date the request concerns. A successful call to a general switchboard does not establish that the person reached has authority to approve new payment instructions.

Use the organization’s approved secure channel for necessary banking information. Do not spread complete account details across ordinary tickets or group messages merely to demonstrate that a call took place. The general change record can reference restricted supporting material and record who compared it. A reviewer needs a traceable basis for the decision without an unnecessary new collection of sensitive data.

Do not count an incoming call as the callback just because the caller knows the invoice number. If the requested contact route cannot be established independently, or the supplier’s authority remains unclear, record that limitation. A confident voice, a familiar name or pressure from a senior employee does not resolve the missing evidence.

Compare the exact change before authorizing it

Separate the changes into fields that another reviewer can understand. The request might involve an account destination, beneficiary name, payment method, currency, supplier legal entity or effective date. Treat differences according to their business significance. A new destination accompanied by a new beneficiary entity needs more explanation than an unchanged supplier reference.

Record the currently approved state, the proposed state and the evidence supporting each material change in the restricted location designated for that information. In the general worksheet, use a reference to that comparison. Avoid copying full account numbers into a widely shared checklist or using an informal screenshot as the only record.

Resolve mismatches through the authorized finance and supplier-contact process. A bank letter or signed attachment can be supporting material, but it should not displace independent confirmation merely because it looks official. Likewise, an email from a familiar domain is not a substitute for checking the particular change. Our DMARC, DKIM and SPF guide covers email authentication; this workflow concerns the authority for a specific payment instruction.

Keep the commercial decision visible too. Which legal entity is being paid, for what obligation, and under whose authority? If a request appears to redirect payment to another entity, involve the responsible finance or procurement owner. Do not have the person entering the change improvise an answer from a resemblance between company names.

Define the acceptable outcome before seeking approval. For this record, “verified” should identify the change that was checked, the independent contact route used and any remaining limitation. “We spoke to someone” is too broad to explain why a particular destination was accepted.

Separate verification, record updates and payment release

A completed callback does not complete the vendor change. Keep three decisions visible: whether the proposed instructions have been verified, whether an authorized change was saved correctly, and whether the actual payment is approved for release. These decisions may involve different people and evidence.

Where your process provides separate roles, have the authorized reviewer assess the evidence before the vendor-record maintainer applies the change. The person approving the payment should then be able to see the relevant approved record. If a small team cannot provide independent review within the normal workflow, escalate that control gap to the accountable finance owner. Do not describe a second click by the same person as an independent check.

Read back the saved vendor record after the authorized update. Compare it with the approved change and record the result. An approval message establishes a decision; it does not establish that the intended fields were saved to the intended supplier. Include the supplier identifier and the time of the read-back so that the evidence remains understandable later.

Check the affected payment separately. A payment batch may have been prepared before the vendor update, or the transaction may use instructions entered elsewhere. Establish which destination the actual payment will use through the organization’s authorized payment-review process. Do not assume that a successful vendor-record update automatically changes every queued transaction.

Any mismatch returns to the responsible owner with the affected payment held under the agreed process. The objective is an authorized, traceable release decision. A worksheet should not offer a shortcut around controls in the finance system or encourage someone to initiate a test transfer as proof of legitimacy.

Use a change record that another reviewer can follow

The EPA Office of Inspector General’s fraud alert recommends organizational policies with multiple verification steps for new payment instructions. The worksheet below is an original way to organize those steps. Adapt it to the actual supplier relationship, authority structure and finance system.

Record	What to capture	What keeps it open
Request and scope	Supplier identifier, request reference, affected invoice or batch, owner.	The affected supplier or payment cannot be identified.
Independent contact	Contact route provenance, person reached, role and verification time.	The route comes only from the request or authority is unclear.
Proposed change	Restricted comparison reference, material differences, effective date.	Fields conflict or the intended beneficiary remains uncertain.
Authorization	Approver, decision, scope and unresolved exceptions.	Approval is absent or covers a different change.
Saved record	Updater, supplier identifier, read-back time and comparison result.	The saved values have not been checked.
Payment disposition	Payment reference, authorized destination review and release or hold decision.	The actual transaction has not been reconciled.

Use separate states rather than one “done” checkbox. For example, a record might be received, contact established, change verified, authorized, saved and checked, then payment reviewed. A hold is a valid state at any stage. Name the reason and next action instead of letting an empty field look like an implicit approval.

Set access and retention through your organization’s approved information-handling process. The worksheet should point to necessary evidence, not become an unrestricted archive of invoices, account details and personal contact information. Record meaningful changes so the next reviewer can distinguish the original request from a later correction.

Work through a fictional supplier request

Consider an invented example. Cedar Workshop receives an email about an unpaid invoice from its fictional supplier, Harbor Components. The message sits in an existing conversation and says future payments must use a new bank account. It also supplies a new telephone number for confirmation. These names and events are illustrative; no transaction or callback was performed.

The accounts-payable coordinator creates change record VC-014 and asks the finance owner to hold the affected change and invoice. The proposed instructions remain separate from the approved vendor record. The coordinator finds the supplier contact route in the organization’s established records rather than using the new number in the email.

Through that route, the coordinator reaches the supplier’s usual finance contact. The contact confirms that a banking change is being discussed but cannot yet confirm the final instructions. The coordinator records the conversation and its limitation. The call has established a contact, but it has not verified the proposed destination or authorized a vendor update.

VC-014 therefore remains held. Its next action is for the authorized finance owner to obtain and independently confirm the final change through the agreed secure process. The coordinator does not fill the gap with the email attachment, assume the new account is correct, or release payment because a callback box can now be ticked.

If the request is later verified and approved, the remaining work still includes the saved vendor-record comparison and the affected payment review. If the supplier disputes the request, the owner escalates it as a suspected incident. The example illustrates a decision trail, not a claim that a particular sequence always detects fraud.

Handle failed verification and suspected transfers explicitly

When verification fails, preserve the actual reason. “No independently established contact route” and “the known supplier disputes the change” are different findings. Both require an accountable next step; neither should be hidden behind a generic completed status. Keep the affected request on hold under the finance owner’s process.

If pressure is applied to bypass the review, record the requested exception and escalate it through the established authority route. An exception decision should identify its scope and unresolved risk. It should not relabel missing verification as successful verification. Contact availability, commercial urgency and payment deadlines need a business decision rather than an invented green result.

If a suspected fraudulent payment has already been sent, contact the financial institution immediately through its established fraud or service route and involve the organization’s finance and incident-response leads. The IC3’s BEC guidance directs victims to contact the originating institution promptly and file a detailed complaint. Ask the institution which recovery actions and documentation apply; recovery is not guaranteed.

Preserve the relevant message, change history and payment reference in the approved restricted location. Do not wait for a complete internal report before making the urgent contact. For wider incident coordination, use the small-business incident response plan. Staff who received suspicious calls or messages can also consult the mobile phishing response guide.

Check the process with a harmless walkthrough

Before relying on the worksheet, walk through a fictional request with the people who would receive it, maintain the vendor file and approve payment. Use dummy references and no real banking destination. Do not make a payment or change a production vendor record to demonstrate that the instructions are understandable.

Ask each person to identify the next owner, the contact information they would trust, the evidence they need and the condition that keeps the request held. Include an unavailable approver and an unconfirmed destination in the discussion. If the handoff depends on someone guessing what “verified” means, clarify the record and the authorized procedure.

Keep this walkthrough separate from a financial-controls audit or a tested fraud-detection claim. It can reveal unclear responsibilities, but it cannot certify your bank connection, vendor identity or system configuration. Review the procedure again when responsibilities or payment processes change.

Make one change traceable from request to disposition

Start with the next supplier banking-change request and give it a clear owner, an independently established verification route and a visible state. Carry its reference through approval, the saved vendor record and the affected payment decision. If a stage remains unresolved, leave that uncertainty visible to the person authorized to act on it.

Methodology and limits: Official FBI, IC3, EPA OIG and NCUA guidance was reviewed on October 30, 2026. The record design, diagram sequence and fictional example are original editorial applications. No bank access, supplier interview, callback, ERP test or transaction was performed. This guide does not establish legal compliance, insurance coverage, control certification or guaranteed fraud prevention.