To verify a supplier bank detail change safely, Accounts Payable should pause the request, confirm it through an independent contact, validate the new account, obtain documented approval and hold the first payment until the review is complete.
A familiar sender or genuine email thread does not prove that new bank details are safe. If a supplier’s mailbox has been compromised, a fraudster may be able to send a convincing request from the real account and continue an existing conversation.
For UK AP teams that want to automate supplier account checks and payment controls, Trustpair’s accounts payable fraud prevention solution can help strengthen the verification process.
Key Takeaways
• Treat every supplier bank detail change as a high-risk request.
• Use contact information already held in approved supplier records.
• Verify the new account against the correct legal entity and UK banking details.
• Keep verification, supplier record updates and payment approval separate.
• Hold the first payment until the change has passed a final review.
Why Does Every Supplier Bank Detail Change Require Verification?
Every supplier bank detail change requires verification because it can redirect a legitimate payment to a fraudulent account.
Fraudsters may impersonate a supplier, compromise a supplier’s email account, manipulate an existing conversation or pose as an employee authorised to update payment instructions. The request may include accurate invoice information, familiar branding and a realistic explanation for the change.
AP should verify two separate facts:
- The supplier genuinely requested the change.
- The new account belongs to the supplier that should receive the payment.
A supplier contact confirming the request does not necessarily prove that the bank account belongs to the correct legal entity. Both parts of the verification should be documented.
A compromised supplier mailbox can make a fraudulent bank detail change look genuine, so teams should understand how supplier email compromise can lead to payment fraud.
What Should AP Do When a Supplier Bank Change Request Arrives?
When a request arrives, AP should log the original message, pause affected payments and avoid updating the supplier record until verification is complete.
Preserve the Original Request
Record the sender, date and time, supplier name, invoice or purchase order referenced, existing bank details, proposed bank details and reason given for the change.
Preserve the original email, attachments and message history. Do not rely on a copied summary, particularly if the request later needs to be investigated.
Identify the Requested Changes
The workflow should cover changes to the:
• Account number or sort code.
• Bank name or account holder.
• Payment method, such as Bacs, CHAPS, Faster Payments or direct debit.
• Supplier legal entity.
• Remittance instructions.
• Payment contact details.
Urgency should be treated as a reason to pause, not a reason to accelerate payment. Requests that include phrases such as “pay today” or “do not contact the usual representative” require additional scrutiny.
How Should AP Confirm the Supplier’s Request?
AP should confirm the request through a known supplier contact and an independent communication channel.
Use a Known Contact
Do not use the telephone number, email address, website link or other contact information included in the bank change request. Instead, use information already stored in the supplier master record, original contract, onboarding documents or a previously validated supplier portal.
Ask the contact to confirm the exact change rather than simply asking whether they sent an email:
“We received a request to change the bank account used for your payments. Before we update our records, can you confirm the exact new account details and the reason for the change?”
The contact should confirm the account holder, bank, sort code, account number and effective date where relevant.
A documented callback should record who was contacted, their role, the number used, the date and time of the call, the information confirmed and any discrepancies identified, helping teams apply effective callback procedures to prevent payment fraud.
Verify the Requester’s Authority
Confirm the requester’s name, role, department and authority to change payment instructions.
If the supplier has recently changed its finance or treasury contacts, treat that as a separate change requiring validation. Do not replace existing contact details solely because new contact information was included in the request.
A second supplier contact may be appropriate when the payment is high-value, international, unusually urgent or connected to a new subsidiary.
How Should AP Validate the New Bank Information?
AP should compare the old and new details, confirm the exact proposed account with the supplier and verify that the account belongs to the correct legal entity.
Check UK Banking Details
Review the account holder name, bank name, sort code, account number, country, currency, payment method, IBAN or BIC where relevant, and remittance instructions.
A valid sort code does not prove that the account belongs to the intended supplier. Sort codes identify a bank and branch, but additional checks are needed to confirm account ownership and beneficiary details.
Confirmation of Payee can provide an additional name check for eligible UK domestic payments. However, it does not confirm that the supplier actually requested the bank detail change, so it should complement rather than replace independent verification.
Supporting documents such as bank letters, statements or account confirmation forms can help, but they should not be treated as standalone proof. Documents can be forged or altered.
Check the Supplier’s Legal Entity
The account holder should match the supplier legal entity entitled to receive payment.
For UK suppliers, relevant checks may include the Companies House registration number, registered address, VAT registration number and UTR where appropriate. Cross-border suppliers may also require checks on IBAN, BIC or other beneficiary information.
An account registered to another subsidiary, an individual, an intermediary or an unrelated company should trigger an exception review. Applying UK supplier master data controls for UTRs, VAT information and bank details can help AP teams identify and investigate these discrepancies.
Who Should Approve and Enter the Bank Detail Change?
The person who verifies a supplier bank detail change should be separate from the person who requested or entered it. High-risk changes should require a second approver.
Apply Separation of Duties
Separating these responsibilities reduces the risk that one employee can submit a fraudulent request, modify the supplier record and release payment without independent review.
The approval record should include the old and new bank details, supplier legal entity, verification method, person contacted, supporting documents, exceptions, approvers and timestamps.
The approver should reject the change when independent verification is missing, contradictory or based only on documents supplied by the requester.
Update the ERP Record Carefully
Only authorised employees should be able to edit supplier bank information. After approval, the data-entry employee should compare every field against the verified request.
The ERP audit trail should preserve the previous account information and record who entered the new details, who verified the request, who approved the change and when the change became effective.
Do not overwrite historical bank information. Previous details may be needed to investigate fraud or identify repeated unauthorised changes.
Should AP Hold the First Payment to a New Account?
Yes. AP should hold the first payment to a newly changed account until the verification evidence has been reviewed and all required approvals are complete.
Before releasing the payment, AP should confirm that the payment file matches the approved bank details and that no newer change request has been submitted. The invoice, purchase order and payment amount should also be reviewed.
A small test payment is not always a safe control because it can still send money to a fraudulent account. Follow the organisation’s treasury and payment policy instead.
After payment, confirm receipt through a known supplier contact where appropriate. An approved invoice does not guarantee that funds reached the intended account, because invoice fraud and payment fraud target different parts of the payment process.
What Should AP Do If the Bank Details Appear Fraudulent?
If the request appears fraudulent, AP should immediately stop pending payments connected to the account and escalate the incident.
The team should contact the bank’s fraud team as soon as possible if funds have already been sent and ask about available recall or recovery procedures. It should also notify finance leadership, treasury, security and the legitimate supplier through a known communication channel.
Preserve the original emails, attachments, message headers, call records, approvals, ERP history, timestamps and transaction information. Do not delete suspicious messages or forward them casually.
UK organisations can report payment diversion fraud through Report Fraud. Its guidance identifies altered payment instructions, impersonation and compromised email accounts as common features of payment diversion fraud.
How Can AP Strengthen Supplier Bank Change Controls?
A strong process combines independent verification, restricted access, continuous monitoring and regular testing.
Supplier contact, legal entity, tax and bank information should be kept current. Inactive and duplicate supplier records should also be reviewed because inaccurate master data can make verification more difficult.
Access to bank detail fields should be limited to authorised employees, and permissions should be reviewed regularly. Supplier setup, bank verification, payment approval and payment release should be separated wherever possible.
Continuous monitoring can help identify unusual or unauthorised changes between scheduled reviews, giving AP teams greater visibility into supplier master data risks.
AP teams should also test the process through tabletop exercises. Useful scenarios include a compromised supplier mailbox, an urgent payment request, a new legal entity or a bank account in a different country.
What Is the AP Checklist for Every Supplier Bank Detail Change?
Use this short checklist for every request:
- Log the request and preserve the original message.
- Pause payments connected to the change.
- Compare the existing and proposed bank details.
- Contact a known supplier representative through an approved channel.
- Confirm the requester’s authority and the exact new account.
- Verify the account holder, legal entity and relevant UK banking details.
- Obtain independent approval before updating the ERP record.
- Preserve the previous account and complete audit trail.
- Hold the first payment until the final review is complete.
- If fraud is suspected, stop payments, contact the bank, notify the supplier and preserve all evidence.