A callback procedure is an outbound phone call to a trusted, independently sourced number, used to confirm that a vendor really requested a payment or a change to its bank details. To be effective, a callback must use a number that doesn’t come from the request itself, ask the vendor to state the details, and leave a written record before the payment is released.
Callbacks remain one of the most widely used controls against payment fraud: 48% of companies still rely on manual fraud prevention methods, according to Trustpair’s 2026 Fraud Report. But a callback is only as strong as the phone number, the questions and the evidence behind it. This guide explains how to run a secure callback, what to record, when callbacks fail, and how to combine them with automated validation to verify vendor payments more securely and efficiently.
Call Back Procedures Key Takeaways:
- A callback is an outbound phone verification that confirms a vendor’s identity, payment request or change of bank details.
- Always call a number from a trusted, independent source, never one taken from the email, invoice or request.
- Ask the vendor to state the payment details rather than confirm the ones you read out.
- Document every callback (who, which number, where it came from, what was confirmed, the outcome) before releasing payment. Without a record, the control is hard to prove to auditors.
- Callbacks fail when the number, the contact details or the supplier’s own inbox has been compromised, or when urgency overrides the process.
- Automated bank account validation and callbacks are complementary: automation handles routine checks, human-led callbacks handle higher-risk cases. Trustpair can do both on your behalf.
- A strong vendor verification process combines identity checks, account validation, documented procedures and human confirmation when needed.
When should you perform a callback?
Perform a callback whenever money could be redirected or a fraudster could exploit a gap in your process:
- A vendor requests a change to its bank details. This is the highest-risk moment. The request may come from an impersonator, or from the vendor’s real but compromised email account. A callback confirms whether the vendor actually made the request and stops the payment from being redirected.
- A new supplier is onboarded. Errors in bank details can delay payments, and fake or impersonated suppliers can give fraudulent account details from day one. A callback, combined with account validation, confirms the supplier is who it claims to be.
- An urgent or unexpected payment request arrives, including from internal staff. CEO fraud increasingly uses SMS (smishing) and phone calls (vishing) to look credible. Calling back on a known internal number confirms the request is real.
- An invoice doesn’t match the purchase order or vendor record. Different payment instructions, amounts or account details may be an error, an undocumented agreement or a fraud attempt. A callback gives a clear answer before you pay.
- A request shows other fraud red flags, such as pressure to act quickly, requests to keep it confidential, or a new country for the bank account.
For broader guidance, see our article on how to verify wire instructions securely.
How to perform a secure callback: 6 steps
A secure callback is part of a documented, layered verification process, not a single phone call.
1. Treat unexpected requests with caution
Review payment requests and bank detail changes carefully, especially when they arrive by email or carry urgent instructions. Business email compromise relies on impersonation, urgency and social engineering to make fraudulent requests look legitimate.
2. Use an independently verified phone number
Never use the phone number in the email, invoice or request. Use a number from your approved vendor record, a previously verified source or the vendor’s official website. If the phone number on file was itself changed recently, verify that change first (see “When do callbacks fail?” below).
When Trustpair performs the callback, its agents use trusted, independently sourced contact information.
3. Apply the four-eyes principle
The person making the callback should be different from the person who initiated or approved the request. This separation of duties, also known as the four-eyes principle, prevents one person from controlling a payment decision alone and strengthens your audit trail.
4. Ask the vendor to state the payment details
Don’t ask “Can you confirm the account ending in 4821?” because that invites a yes. Ask the vendor to state the bank name, account details or the change they requested, and compare the answer with the request. For extra assurance, combine the callback with real-time account ownership verification or instant account verification.
5. Document the outcome before releasing payment
Record the call (see the log below) and get it reviewed before the vendor record is updated or the payment is released. A callback that isn’t documented is hard to prove to auditors and easy to skip under pressure.
6. Watch for later changes
Fraudsters often strike after onboarding, by changing contact details first and bank details later. Monitor your vendor master data for changes to bank accounts, phone numbers and email addresses so every sensitive change triggers a new verification. Learn more about continuous vendor master data monitoring and how to keep SAP vendor master data clean and monitored.
What should you record after a callback?
A callback protects you, and satisfies auditors, only if it leaves evidence. Record the following for every callback before the payment or vendor change is approved:
Keep these records in line with your internal retention policy so they’re available for audits and investigations.
When do callbacks fail?
Callbacks are only as strong as the phone number and process behind them. They fail when:
- The number comes from the request itself. If you dial the number in the email signature or on the invoice, you may reach the fraudster.
- The contact details were changed first. Fraudsters sometimes change a vendor’s phone number or email in your records before requesting a bank change, so your “callback” reaches them.
- The supplier’s own email account is compromised. The request looks genuine because it really comes from the supplier’s inbox. Only an independent callback, or an automated ownership check, catches it.
- The question gives the answer away. Reading out the new details and asking for a yes confirms nothing.
- An incoming call is treated as verification. Caller ID can be spoofed and voices can be cloned with AI. Only an outbound call to a trusted number counts.
- Urgency wins. When the vendor can’t be reached and the payment is “urgent,” teams release it anyway. Escalate instead, and document the decision.
Callbacks, audits and Nacha compliance
Callbacks are a common internal control for bank detail changes, and auditors look for consistent evidence that they were performed: who called, which number was used and what was confirmed.
In the US, Nacha’s 2026 rules require businesses that send ACH payments to have documented, risk-based processes to detect fraudulent payments, such as those resulting from business email compromise. Documented callbacks and automated account validation can support those processes, although Nacha doesn’t require either method specifically. Use our Nacha compliance checklist to review your controls.
How do automation and callbacks work together?
Automation and callbacks serve different but complementary purposes.
Automated bank account validation quickly checks whether a vendor’s account details match trusted banking data. It’s fast, independent and doesn’t depend on reaching the vendor.
A callback is a direct conversation with the vendor. It confirms that the vendor initiated the request, clarifies conflicting information and adds human confirmation when the risk calls for it.
Trustpair combines both. When an automated check is enough, it speeds up verification. When a phone conversation is needed, Trustpair agents make the callback using trusted contact information and document the outcome. You don’t have to choose between callbacks and automation. You apply the right control to each situation.
Read more about vendor validation automation and how Trustpair protects outgoing payments through payment validation and automated account checks.
How can Trustpair make callbacks scalable?
Manual callbacks are hard to sustain when you work with thousands of vendors across several countries. Trustpair reduces this workload by having its agents perform vendor callbacks on your behalf, while automated validation handles routine checks and flags cases that need human review.
This approach lets you:
- Keep phone verification in your control framework.
- Reduce the workload on accounts payable and procurement teams.
- Use automated validation where it fits.
- Escalate unusual or high-risk cases to human-led verification.
- Keep a documented, traceable record of every verification.
The goal isn’t to remove callbacks. It’s to make them consistent, targeted, scalable and easy to show auditors.
