\n\n\n
Key Takeaways:<\/span><\/h3>\n\n- A callback is an outbound phone verification that confirms a supplier’s identity, payment request or change of bank details.<\/li>\n
- Always call a number from a trusted, independent source, never one taken from the email, invoice or request.<\/li>\n
- Ask the supplier to\u00a0state<\/strong>\u00a0the payment details rather than confirm the ones you read out.<\/li>\n
- Document every callback<\/strong>\u00a0(who, which number, where it came from, what was confirmed, the outcome) before releasing payment. Without a record, the control is hard to evidence to auditors and the board.<\/li>\n
- Callbacks fail when the number, the contact details or the supplier’s own inbox has been compromised, or when urgency overrides the process.<\/li>\n
- Confirmation of Payee helps, but it doesn’t replace a callback: it checks the account name, not whether the supplier actually made the request.<\/li>\n
- A strong\u00a0supplier verification process<\/a>\u00a0combines identity checks, account validation, documented procedures and human confirmation when needed.<\/li>\n<\/ul>\n\n\n
\n\n\n\nWhen should you perform a callback?<\/h2>\nPerform a callback whenever money could be redirected or a fraudster could exploit a gap in your process:<\/div>\n\n- A supplier requests a change to its bank details.<\/strong>\u00a0This is the highest-risk moment. The request may come from an impersonator, or from the supplier’s real but compromised email account. A callback confirms whether the supplier actually made the request and stops the payment from being redirected.<\/li>\n
- A new supplier is onboarded.<\/strong>\u00a0Errors in the sort code or account number can delay payments, and fake or impersonated suppliers can give fraudulent bank details from day one. A callback, combined with account validation, confirms the supplier is who it claims to be.<\/li>\n
- An urgent or unexpected payment request arrives<\/strong>, including from internal staff. CEO fraud increasingly uses SMS (smishing), phone calls (vishing) and even\u00a0deepfake voices<\/a>\u00a0to look credible. Calling back on a known internal number confirms the request is real.<\/li>\n
- An invoice doesn’t match the purchase order or supplier record.<\/strong>\u00a0Different payment instructions, amounts or bank details may be an error, an undocumented agreement or a fraud attempt. A callback gives a clear answer before you pay.<\/li>\n
- A request shows other fraud red flags<\/strong>, such as pressure to act quickly, requests to keep it confidential, or a bank account in a new country.<\/li>\n<\/ol>\n
\n\n\n
\nWhen should you perform a callback?<\/h2>\n
When should you perform a callback?<\/h2>\nPerform a callback whenever money could be redirected or a fraudster could exploit a gap in your process:<\/div>\n\n- A supplier requests a change to its bank details.<\/strong>\u00a0This is the highest-risk moment. The request may come from an impersonator, or from the supplier’s real but compromised email account. A callback confirms whether the supplier actually made the request and stops the payment from being redirected.<\/li>\n
- A new supplier is onboarded.<\/strong>\u00a0Errors in the sort code or account number can delay payments, and fake or impersonated suppliers can give fraudulent bank details from day one. A callback, combined with account validation, confirms the supplier is who it claims to be.<\/li>\n
- An urgent or unexpected payment request arrives<\/strong>, including from internal staff. CEO fraud increasingly uses SMS (smishing), phone calls (vishing) and even\u00a0deepfake voices<\/a>\u00a0to look credible. Calling back on a known internal number confirms the request is real.<\/li>\n
- An invoice doesn’t match the purchase order or supplier record.<\/strong>\u00a0Different payment instructions, amounts or bank details may be an error, an undocumented agreement or a fraud attempt. A callback gives a clear answer before you pay.<\/li>\n
- A request shows other fraud red flags<\/strong>, such as pressure to act quickly, requests to keep it confidential, or a bank account in a new country.<\/li>\n<\/ol>\n
- \n
- A supplier requests a change to its bank details.<\/strong>\u00a0This is the highest-risk moment. The request may come from an impersonator, or from the supplier’s real but compromised email account. A callback confirms whether the supplier actually made the request and stops the payment from being redirected.<\/li>\n
- A new supplier is onboarded.<\/strong>\u00a0Errors in the sort code or account number can delay payments, and fake or impersonated suppliers can give fraudulent bank details from day one. A callback, combined with account validation, confirms the supplier is who it claims to be.<\/li>\n
- An urgent or unexpected payment request arrives<\/strong>, including from internal staff. CEO fraud increasingly uses SMS (smishing), phone calls (vishing) and even\u00a0deepfake voices<\/a>\u00a0to look credible. Calling back on a known internal number confirms the request is real.<\/li>\n
- An invoice doesn’t match the purchase order or supplier record.<\/strong>\u00a0Different payment instructions, amounts or bank details may be an error, an undocumented agreement or a fraud attempt. A callback gives a clear answer before you pay.<\/li>\n
- A request shows other fraud red flags<\/strong>, such as pressure to act quickly, requests to keep it confidential, or a bank account in a new country.<\/li>\n<\/ol>\n
- A new supplier is onboarded.<\/strong>\u00a0Errors in the sort code or account number can delay payments, and fake or impersonated suppliers can give fraudulent bank details from day one. A callback, combined with account validation, confirms the supplier is who it claims to be.<\/li>\n
![\"New](\"https:\/\/no-cache.hubspot.com\/cta\/default\/5278241\/7103e12e-2d1e-4eb3-8870-44e22fddd107.png\")
<\/a><\/span>