To verify a vendor bank change safely, Accounts Payable should pause the request, confirm it through an independent contact, validate the new account, obtain documented approval, and hold the first payment until the review is complete.
A familiar sender or legitimate email thread does not prove that new bank details are safe. If a vendor mailbox has been compromised, a fraudster may be able to send a convincing request from the real account.
For AP teams that want to automate vendor account checks and payment controls, Trustpair’s accounts payable fraud prevention solution can help strengthen the verification process.
Key Takeaways
• Treat every vendor bank change as a high-risk request.
• Confirm the request using contact information already held in approved vendor records.
• Verify that the new account belongs to the correct vendor legal entity.
• Separate verification, ERP updates, and payment approval responsibilities.
• Hold the first payment until the change has passed a final review.
Why Does Every Vendor Bank Change Require Verification?
Every vendor bank change requires verification because it can redirect legitimate payments to a fraudulent account.
Fraudsters may impersonate a supplier, compromise a vendor’s email account, manipulate an existing conversation, or pose as an employee authorized to update payment information. The request may include accurate invoice data, familiar branding, and a realistic explanation for the change.
That is why AP should verify two separate facts:
- The vendor genuinely requested the change.
- The new account belongs to the vendor that should receive the payment.
A vendor contact confirming the request does not necessarily prove that the bank account belongs to the correct legal entity. Both parts of the verification must be documented.
For more information about compromised vendor email accounts, read our latest article on how to spot and stop fraudulent bank detail change.
What Should AP Do When a Bank Change Request Arrives?
When a request arrives, AP should log the original message, pause affected payments, and avoid changing the vendor record until verification is complete.
Preserve the Original Request
Record the sender, date, time, vendor name, invoice or purchase order referenced, existing bank details, proposed bank details, and reason given for the change.
Preserve the original email, attachments, and message history. Do not rely on a copied summary, particularly when the request may later need to be investigated.
Identify the Requested Changes
The verification workflow should cover changes to the:
• Account number or routing number.
• Bank name or account holder.
• Payment method, such as ACH or wire.
• Vendor legal entity.
• Remittance instructions.
• Payment contact information.
Urgency should be treated as a reason to pause, not a reason to accelerate payment. Requests that include phrases such as “pay today” or “do not contact the usual representative” require additional scrutiny.
How Should AP Confirm the Request?
AP should confirm the request through a known vendor contact and an independent communication channel.
Use a Known Contact
Do not use the phone number, email address, website link, or other contact information included in the bank change request. Instead, use information already stored in the vendor master record, original contract, onboarding documents, or a previously validated vendor portal.
Ask the contact to confirm the exact change rather than simply asking whether they sent an email:
“We received a request to change the bank account used for your payments. Before we update our records, can you confirm the exact new account details and the reason for the change?”
The contact should confirm the account holder, bank, routing number, account number, and effective date when relevant.
For additional guidance, learn how to verify wire instructions to avoid payment fraud.
Verify the Requester’s Authority
Confirm the requester’s name, role, department, and authority to change payment instructions.
If the vendor recently changed its finance or treasury contacts, treat that as a separate change requiring validation. Do not replace existing contact information solely because new contact details were included in the request.
A second vendor contact may be appropriate when the payment is high-value, international, unusually urgent, or connected to a new subsidiary.
How Should AP Validate the New Bank Information?
AP should compare the old and new details, confirm the exact proposed account with the vendor, and verify that the account belongs to the correct legal entity.
Compare the Old and New Details
Review the account holder name, bank name, routing number, account number, country, currency, payment method, and remittance instructions.
Routing-number validation alone is not sufficient. It may confirm a bank or branch but does not necessarily prove account ownership.
Supporting documents such as bank letters, voided checks, or account confirmation forms can help, but they should not be treated as standalone proof. Documents may be forged or altered.
Check the Legal Entity
The account holder should match the vendor legal entity that is entitled to receive payment.
An account registered to another subsidiary, an individual, an intermediary, or an unrelated company should trigger an exception review. Additional scrutiny is also appropriate when the country or currency changes unexpectedly, or when the request is linked to a merger, acquisition, or restructuring.
To strengthen these checks, AP teams should also apply vendor master data controls covering EIN/TIN matching, W-9 data, and bank details.
Who Should Approve and Enter the Bank Change?
The person who verifies a bank change should be separate from the person who requested or entered it. High-risk changes should require a second approver.
Apply Separation of Duties
Separating these responsibilities reduces the risk that one employee can submit a fraudulent request, modify the vendor record, and release payment without independent review.
The approval record should include the old and new bank details, vendor legal entity, verification method, person contacted, supporting documents, exceptions, approvers, and timestamps.
The approver should reject the change when independent verification is missing, contradictory, or based only on documents supplied by the requester.
Update the ERP Record Carefully
Only authorized employees should be able to edit vendor bank information. After approval, the data-entry employee should compare every field against the verified request.
The ERP audit trail should preserve the previous account information and record:
• Who entered the new details.
• Who verified the request.
• Who approved the change.
• When the change became effective.
Do not overwrite historical bank information. Previous details may be needed to investigate fraud or identify repeated unauthorized changes.
Should AP Hold the First Payment to a New Account?
Yes. AP should hold the first payment to a newly changed account until the verification evidence has been reviewed and all required approvals are complete.
Before releasing the payment, AP should confirm that the payment file matches the approved bank details and that no newer change request has been submitted. The invoice, purchase order, and payment amount should also be reviewed.
A small test payment is not always a safe control because it can still send money to a fraudulent account. Follow the organization’s treasury and payment policy instead.
After payment, confirm receipt through a known vendor contact when appropriate. An approved invoice does not guarantee that funds reached the intended account, because invoice fraud and payment fraud target different parts of the payment process.
What Should AP Do If the Bank Details Appear Fraudulent?
If the request appears fraudulent, AP should immediately stop pending payments connected to the account and escalate the incident.
The team should contact the bank as soon as possible if funds have already been sent and ask about available recall or recovery procedures. AP should also notify finance leadership, treasury, security, and the legitimate vendor through a known communication channel.
Preserve the original emails, attachments, message headers, call records, approvals, ERP history, timestamps, and transaction information. Do not delete suspicious messages or forward them casually.
Suspected business email compromise can also be reported through the FBI’s Internet Crime Complaint Center.
How Can AP Strengthen Vendor Bank Change Controls?
A strong process combines independent verification, restricted access, continuous monitoring, and regular testing.
Vendor contact, legal entity, tax, and bank information should be kept current. Inactive and duplicate vendor records should be reviewed because inaccurate master data can make verification more difficult.
Access to bank detail fields should be limited to authorized employees, and permissions should be reviewed regularly. Vendor setup, bank verification, payment approval, and payment release should be separated wherever possible.
Continuous monitoring can help identify unusual or unauthorized changes between scheduled reviews, giving AP teams greater visibility into vendor master data risks.
AP teams should also test the process through tabletop exercises. Useful scenarios include a compromised vendor mailbox, an urgent payment request, a new legal entity, or a bank account in a different country.
What Is the AP Checklist for Every Vendor Bank Change?
Use this short checklist for every request:
- Log the request and preserve the original message.
- Pause payments connected to the change.
- Compare the existing and proposed bank details.
- Contact a known vendor representative through an approved channel.
- Confirm the requester’s authority and the exact new account.
- Verify the account holder and vendor legal entity.
- Obtain independent approval before updating the ERP record.
- Preserve the previous account and complete audit trail.
- Hold the first payment until the final review is complete.
- If fraud is suspected, stop payments, contact the bank, notify the vendor, and preserve all evidence.