Supplier Changed Bank Details? Checks Before You Pay
A new bank account on a familiar invoice deserves a fresh check. Here is how to verify the request, investigate a different beneficiary, and document your decision.
If a supplier changes its bank details, pause the payment and verify the request through a contact channel you already trust. Check who is asking, which legal entity will receive the money, and why the instructions changed. A familiar email thread or a genuine company registration does not authenticate a new bank account.
This guide is for business owners, procurement teams and accounts-payable staff handling supplier payments. It separates payment-instruction checks from company due diligence so you can ask the right questions before releasing funds.
Why a genuine supplier can appear in a payment scam
The supplier itself may be legitimate. The payment instructions may not be.
The FBI describes how criminals who gain access to business email can study transactions and impersonate vendors to redirect payments. A message can therefore contain accurate invoice details and still give you a fraudulent destination. See the FBI's explanation of compromised email and redirected payments.
That distinction matters. Finding an active company in a registry answers a question about the business. It does not establish that the person sending today's payment instructions is authorized to change them.
A supplier bank-detail change checklist
Use the following as an internal working checklist, adapted to your payment procedures.
1. Hold the payment and the account amendment
Put both actions on hold while you investigate. Updating the supplier record without sending money can still expose the next invoice to the same problem.
Keep the original invoice and the change request together. Record which details differ: beneficiary name, account number, bank, country, currency or payment intermediary. Avoid circulating full bank details beyond the people who need them.
2. Call a contact you already know
Use a telephone number from your established supplier records or an independently verified source. Do not rely on a new number in the change-request email.
Ask your known contact whether the supplier requested the change and who authorized it. If that contact cannot confirm it, ask to speak to the supplier's finance team through the same trusted route.
The FBI specifically recommends checking payment changes in person or through a known telephone number. A reply in the same email thread does not provide that separate check. Read the FBI recommendation.
3. Compare the beneficiary with the contracting company
Write down the exact legal name on your contract, the invoice issuer and the proposed account beneficiary.
If they differ, ask for a written explanation and supporting evidence of the relationship. Possible explanations include a collection agent, a group treasury company or an invoice-financing arrangement. Treat these as explanations to verify, rather than reasons to approve automatically.
Ask your bank what beneficiary checks are available for the particular payment route. Do not assume that entering a company name guarantees the receiving account belongs to that company.
4. Check any newly introduced entity
If the payment now goes to a different company, identify that company before proceeding. Request its legal name, registration number, jurisdiction and business address.
Check the relevant official registry where accessible. Compare the supplied details with the records and investigate any unexplained differences. Record unavailable information as a gap; do not treat a missing result as proof of fraud or as clearance.
For the broader supplier review, use our guide to vetting a new supplier before payment.
5. Have a second person review the evidence
Where your team can support it, separate the person changing the supplier record from the person authorizing payment.
The reviewer should see the evidence behind the change, including the independent callback, the explanation for any different beneficiary and unresolved questions. A tick box saying “supplier confirmed” is less useful than a short record of who confirmed what and how.
6. Document the decision before releasing funds
Keep a concise decision record:
- Invoice and purchase-order references.
- Date the change request arrived.
- Trusted channel used to verify it.
- Name and role of the person who confirmed it.
- Explanation and evidence for any beneficiary mismatch.
- Outstanding questions and the person authorizing the decision.
If the explanation cannot be independently supported, keep the payment on hold and escalate through your organization's finance or risk process.
When the beneficiary is a different company
Consider this fictional example: your contract is with Meridian Components Ltd., but a revised invoice asks you to pay Harbour Collections Ltd.
A registry search showing that both companies exist leaves the central question unanswered: why is Harbour authorized to collect Meridian's invoice?
Ask for evidence connecting the collection arrangement to your contract. Confirm that arrangement directly with a trusted Meridian contact. If the proposed recipient introduces additional ownership or control questions, investigate those too.
Company verification and confirmation of payment authority are separate tasks. You may need both before the payment makes sense.
When a due diligence report helps
A counterparty report can help when the new instructions reveal that you do not know enough about the supplier or a newly introduced recipient. Relevant questions include its registration, officers, ownership information where available, sanctions exposure and adverse media.
Scrutinex offers Entity reports for company checks. View a sample report to see the format and sources, or start a Standard Entity report for $99. If a separate recipient also needs research, describe both entities and confirm the scope before ordering.
A Scrutinex report does not authenticate a bank account, approve a wire transfer or guarantee recovery. Keep the independent callback and your bank's payment controls in place.
Already paid the changed account?
If you suspect the payment was diverted, contact your sending bank immediately and ask about its fraud-response and recall process. Preserve the emails, invoices and transaction reference. For a US-related incident, the FBI directs victims to report business email compromise to IC3. Use the appropriate local reporting channel for your jurisdiction as well.
The IC3 incident guidance explains the bank-contact and complaint steps. Recovery is uncertain; do not wait for a company report before alerting your bank.
Common questions
Does a bank-account change prove supplier fraud?
No. Businesses can change banking arrangements. It creates a verification task, especially when the beneficiary changes or the request comes with unusual pressure.
Is a signed letter with the new bank details enough?
Treat it as supporting material. Confirm its authenticity and the instruction through an established contact channel before relying on it.
Can I verify the change by replying to the supplier's email?
A reply stays within the channel that may be compromised. Use a known telephone number or another independently established route.
Does a clean company check mean I can pay?
It does not authenticate the instruction or establish ownership of the receiving account. Use the report to assess the entity, alongside separate payment verification.