A call back procedure is an outbound phone call to a trusted, independently sourced number, used to confirm that a supplier really requested a payment or a change to its bank details. To be effective, a callback must use a number that doesn’t come from the request itself, ask the supplier to state the details, and leave a written record before the payment is released.
Callbacks remain one of the most widely used controls against payment fraud: 48% of companies still rely on manual fraud prevention methods, according to Trustpair’s 2026 Fraud Report. But a callback is only as strong as the phone number, the questions and the evidence behind it. This guide explains how to run a secure callback, what to record, when callbacks fail, and how to combine them with automated validation to verify supplier payments more securely and efficiently.
Key Takeaways:
- A callback is an outbound phone verification that confirms a supplier’s identity, payment request or change of bank details.
- Always call a number from a trusted, independent source, never one taken from the email, invoice or request.
- Ask the supplier to state the payment details rather than confirm the ones you read out.
- Document every callback (who, which number, where it came from, what was confirmed, the outcome) before releasing payment. Without a record, the control is hard to evidence to auditors and the board.
- Callbacks fail when the number, the contact details or the supplier’s own inbox has been compromised, or when urgency overrides the process.
- Confirmation of Payee helps, but it doesn’t replace a callback: it checks the account name, not whether the supplier actually made the request.
- A strong supplier verification process combines identity checks, account validation, documented procedures and human confirmation when needed.
When should you perform a callback?
Perform a callback whenever money could be redirected or a fraudster could exploit a gap in your process:
- A supplier requests a change to its bank details. This is the highest-risk moment. The request may come from an impersonator, or from the supplier’s real but compromised email account. A callback confirms whether the supplier actually made the request and stops the payment from being redirected.
- A new supplier is onboarded. Errors in the sort code or account number can delay payments, and fake or impersonated suppliers can give fraudulent bank details from day one. A callback, combined with account validation, confirms the supplier is who it claims to be.
- An urgent or unexpected payment request arrives, including from internal staff. CEO fraud increasingly uses SMS (smishing), phone calls (vishing) and even deepfake voices to look credible. Calling back on a known internal number confirms the request is real.
- An invoice doesn’t match the purchase order or supplier record. Different payment instructions, amounts or bank details may be an error, an undocumented agreement or a fraud attempt. A callback gives a clear answer before you pay.
- A request shows other fraud red flags, such as pressure to act quickly, requests to keep it confidential, or a bank account in a new country.
For broader guidance, see our articles on how to verify payment instructions and bank transfer fraud prevention and recovery.
How to perform a secure callback: 6 steps
A secure callback is part of a documented, layered verification process, not a single phone call.
1. Treat unexpected requests with caution
Review payment requests and bank detail changes carefully, especially when they arrive by email or carry urgent instructions. Business email compromise relies on impersonation, urgency and social engineering to make fraudulent requests look legitimate.
2. Use an independently verified phone number
Never use the phone number in the email, invoice or request. Use a number from your approved supplier record, a previously verified source or the supplier’s official website. If the phone number on file was itself changed recently, verify that change first (see “When do callbacks fail?” below).
When Trustpair performs the callback, its agents use trusted, independently sourced contact information.
3. Apply the four-eyes principle
The person making the callback should be different from the person who initiated or authorised the request. This segregation of duties prevents one person from controlling a payment decision alone and strengthens your audit trail.
4. Ask the supplier to state the payment details
Don’t ask “Can you confirm the account ending 4821?” because that invites a yes. Ask the supplier to state the bank name, sort code, account number or the change they requested, and compare the answer with the request. For extra assurance, combine the callback with Confirmation of Payee, a sort code check and independent account verification.
5. Document the outcome before releasing payment
Record the call (see the log below) and get it reviewed before the supplier record is updated or the payment run is released. A callback that isn’t documented is hard to evidence to auditors and easy to skip under pressure.
6. Watch for later changes
Fraudsters often strike after onboarding, by changing contact details first and bank details later. Monitor your supplier master data for changes to bank accounts, phone numbers and email addresses so every sensitive change triggers a new verification. Learn more about continuous vendor master data monitoring and how to keep SAP vendor master data clean and monitored.
What should you record after a callback?
A callback protects you, and satisfies auditors, only if it leaves evidence. Record the following for every callback before the payment or supplier change is approved:
Keep these records in line with your internal retention policy so they’re available for audits and investigations.
When do callbacks fail?
Callbacks are a useful control, but they don’t guarantee that a payment is safe. They fail when:
- The number comes from the request itself. If you dial the number in the email signature or on the invoice, you may reach the fraudster.
- The contact details were changed first. Fraudsters sometimes change a supplier’s phone number or email in your records before requesting a bank change, so your “callback” reaches them.
- The supplier’s own email account is compromised. The request looks genuine because it really comes from the supplier’s inbox. Only an independent callback, or an automated ownership check, catches it.
- The question gives the answer away. Reading out the new details and asking for a yes confirms nothing.
- An incoming call is treated as verification. Caller ID can be spoofed and voices can be cloned with AI. Only an outbound call to a trusted number counts.
- The person answering isn’t authorised. A receptionist or junior colleague may “confirm” details they can’t vouch for. Speak to an authorised finance contact.
- Urgency wins. When the supplier can’t be reached and the payment is “urgent” (often just before a payment run or month-end), teams release it anyway. Escalate instead, and document the decision.
Manual callbacks are also hard to scale: they take time to make and record, unanswered calls need follow-up, and procedures are applied inconsistently across teams and entities. That’s why callbacks work best as part of a broader process that includes independent data validation, segregation of duties, escalation rules and a clear audit trail.
If a fraud has already happened, follow our 7-step playbook for responding to an impersonation scam.
Callbacks, Confirmation of Payee and UK control requirements
Confirmation of Payee (CoP) checks whether the name you enter matches the name on the receiving UK account. It’s a valuable safeguard, but it doesn’t confirm that the supplier actually requested the change, and it doesn’t cover all international payments. CoP and callbacks answer different questions, so use both. Learn more about the Confirmation of Payee regulation and how to choose a Confirmation of Payee tool.
Reimbursement won’t protect most businesses. The UK’s mandatory reimbursement scheme for authorised push payment (APP) fraud is designed for consumers, micro-enterprises and small charities. Larger organisations generally need to prevent the payment in the first place.
Boards must now evidence their controls. Under Provision 29 of the UK Corporate Governance Code 2024, boards must declare the effectiveness of their material internal controls for reporting periods beginning on or after 1 January 2026. Where payment controls are considered material, consistent callback records, together with automated validation results, give the board and auditors the evidence they need.
How do automation and callbacks work together?
Automation and callbacks serve different but complementary purposes.
Automated bank account validation quickly checks whether a supplier’s account details match trusted banking data. It’s fast, independent and doesn’t depend on reaching the supplier.
A callback is a direct conversation with the supplier. It confirms that the supplier initiated the request, clarifies conflicting information and adds human confirmation when the risk calls for it.
Trustpair combines both. When an automated check is enough, it speeds up verification. When a phone conversation is needed, Trustpair agents make the callback using trusted contact information and document the outcome. You don’t have to choose between callbacks and automation. You apply the right control to each situation. Learn how Trustpair protects outgoing payments through payment validation and automated account checks.
How can Trustpair make callbacks scalable?
Manual callbacks are hard to sustain when you work with thousands of suppliers across several countries. Trustpair reduces this workload by having its agents perform supplier callbacks on your behalf, while automated validation handles routine checks and flags cases that need human review.
This approach lets you:
- Keep telephone verification in your control framework.
- Reduce the workload on accounts payable and procurement teams.
- Use automated validation where it fits.
- Escalate unusual or high-risk cases to human-led verification.
- Keep a documented, traceable record of every verification.
The goal isn’t to remove callbacks. It’s to make them consistent, targeted, scalable and easy to evidence.
