Business IT

Vendor Bank Details Changed? A Payment Verification Checklist

Brandon Phipps

Invoice on a business laptop beside a telephone and approval checklist for verifying vendor payment changes.

4:12

A request to change a supplier's bank details should stay on hold until your business verifies it through a trusted contact. Call a number already held in your approved vendor records and require a separate authorized person to approve the change. Record the check before updating payment instructions or releasing money. For a Bakersfield business handling purchases, outside vendors, or recurring invoices, that process needs a named owner and a backup when someone is away.

What Should You Do When a Vendor Changes Bank Details?

Keep the request with its invoice and vendor record, then follow your written payment-change procedure. Verify the request through a known contact, document separate approval, and check the updated record before payment. An unresolved request stays on hold with a named person responsible for the next step.

The workflow and log below are editorial tools you can adapt with your finance lead, financial institution, and IT provider. Set approval authority and secure handling rules for your own business before staff use them.

Which Requests Need Extra Checking?

Business email compromise can involve an impostor or access to a genuine email conversation. A familiar display name, invoice format, or message thread can accompany a fraudulent request. The FBI advises verifying changes to payment procedures and account numbers through a separate contact check.

A request introduces a new bank account, payment destination, or way to pay.
The sender asks staff to bypass the normal approver or keep the change private.
An urgent cutoff leaves little time for the usual review.
The contact number differs from the one in your approved vendor record.
Payment instructions conflict with purchasing records or an earlier agreement.

Apply the verification rule to every bank-detail change. For the wider email risk, review our AI phishing guidance for small businesses.

A Vendor Payment Verification Checklist

Pause the Change and Assign an Owner

Keep the original request and identify the vendor, related invoice, due date, and current payment status. Assign the person authorized to hold the change. Check whether a payment is already scheduled and alert the employee who can stop its release.

Check the Purchase and Invoice

Compare the invoice with your order and receiving records. The FTC recommends clear procedures for reviewing invoices and approving purchases. A legitimate purchase still needs a separate check of any changed payment instructions.

Call Through an Established Contact

Make an outgoing call using a trusted number from your existing records. Confirm that the person reached has authority to verify the supplier's change. A number supplied in the new request needs independent verification before use. If the request arrived by phone, call back through the established contact route.

Follow your secure vendor process to confirm the account instructions and effective date. Record the contact's name, role, callback time, and outcome. Keep full banking details in the restricted vendor record.

Obtain Separate Approval

Give another authorized approver the callback record and supporting documents. Have that person review the change against your approval policy. Nacha recommends review procedures and dual controls, including arrangements for unavailable approvers. Name an alternate in advance and document their authority.

Update the Record and Check the Payment

After approval, have the responsible employee enter the confirmed instructions into the vendor record. Arrange a check of the saved change. Before release, compare the payment with that approved record, including any invoice already waiting in a payment batch. Keep the payment reference linked to the change log.

A Payment-Change Log Your Team Can Use

Copy these fields into your approved vendor workflow. Limit access to supporting documents and record their secure location. Keep full account numbers, credentials, and confidential attachments out of general meeting notes or IT tickets.

Vendor bank-change verification record
Field	What to Record
Request	Vendor ID, invoice reference, date received, requested effective date, and staff owner.
Payment hold	Who placed the hold, affected payment, and person authorized to release it.
Trusted contact	Source of the established number and the authorized supplier contact reached.
Callback	Date, time, person making the call, outcome, and restricted evidence location.
Approval	Separate approver, authority checked, approval date, or reason the change remains on hold.
Record update	Employee making the approved change and result of the saved-record check.
Payment	Person releasing the payment, date, reference, and check against approved instructions.
Exception	Unresolved issue, named owner, next action, and review date.

What If the Supplier or Approver Is Unavailable?

Keep the hold visible and escalate to the owner or finance lead named in your procedure. Write down who is trying to reach the established supplier contact and when they will try again. A staff absence needs an approved alternate, with the same verification record available for review.

Ask your team to walk through the procedure before a real request arrives. Can staff find the trusted number? Who handles an invoice close to its due date? Where does a replacement approver find the evidence? Record gaps and assign someone to fix each one.

What If Money Has Already Been Sent?

Contact your financial institution immediately. Ask its fraud team about a recall, the documents it needs, and contact with the receiving institution.
Report the incident promptly to the FBI's Internet Crime Complaint Center. Keep the report reference with the transaction record.
Preserve evidence. Retain original messages, attachments, payment instructions, timestamps, and transaction references in an approved restricted location.
Activate your business response process. Notify the authorized finance and IT contacts. Have the team check affected accounts and any related pending payments.

Recovery depends on the transfer and circumstances. The IC3 advises contacting the financial institution immediately and reporting the loss as soon as possible. Start those actions while your team collects further details.

What Should Finance and IT Each Handle?

Finance or the business owner sets payment authority, confirms the vendor relationship, and approves record changes. An IT provider can assess suspected account compromise, review relevant access and email rules, and support the agreed response process. Nacha's response plan includes preserving communications and checking systems, including forwarding rules.

Define that division of work before an incident. Our cybersecurity services information explains how account protection and response responsibilities are scoped. For recurring support, review business IT support in Bakersfield and specify the tasks your agreement covers.

Questions About Vendor Bank Changes

Is a Reply From the Same Email Address Enough?

Use a separate trusted contact check for the change. An email account or genuine conversation may be compromised. Record the callback and approval before payment records change.

What If the Request Comes From the Owner?

Apply the business's written verification and approval rules. Contact the owner through an established route and keep the payment on hold until the required checks are recorded.

Can a Small Team Use Separate Approval?

Name the people authorized to verify and approve changes, including an alternate when one is away. Have the business owner and finance adviser decide how that process fits the team and banking permissions.

Review Your Business Email and Payment Responsibilities

Contact Second Star Technologies to discuss business email security and IT service responsibilities in Bakersfield and Kern County. Keep banking details and confidential invoices out of the initial inquiry. We can discuss your systems and the work you want included in a written service scope.

Editorial review: October 16, 2026. Adapt the worksheet to your business's approval policy and financial institution's procedures.

Read the audio summary transcript

A supplier has asked you to send its next payment to a new bank account. Before anyone edits the vendor record, someone in your business needs to check that request through a trusted contact. Agreeing on that process ahead of time gives your staff a clear way to handle it when a payment is due.

Welcome to The IT Edge: Business Tech Made Simple, from Second Star Technologies. Today we're covering vendor bank changes and the checks a small business can put around them.

The first decision is who owns the request. Name the person who can place a payment on hold and the person who can approve a change. Give them a backup contact for days when someone is away. An approaching cutoff should lead staff to that backup contact, with the payment held until verification is complete.

Start by keeping the original request and linking it to the right vendor and invoice. Check your purchasing records and whether the goods or services were ordered and received. An invoice that looks familiar still needs that basic review.

Next, make an outgoing call using a trusted number your business already has. Use the supplier contact from your approved records. A new number inside the bank-change message needs its own check before you rely on it. If the request arrived by phone, call the supplier back through the established number.

Ask the supplier's authorized contact to confirm that it requested the change. Follow your approved secure process to check the new payment instructions and the date they take effect. Record who confirmed them and how you reached that person. Keep full bank details in the protected vendor record, where access is limited to people who need them.

Then bring in a separate authorized approver. That person should be able to see the callback record and the supporting documents. Have them check that the change was verified and falls within their authority. Once approval is recorded, the staff member responsible for vendor records can make the agreed update.

Before the payment goes out, check it against that approved record. A legitimate invoice may already be sitting in a payment batch with older instructions. Give the person releasing payments a clear way to flag any mismatch. Record the payment reference so the change and payment can be reviewed together.

Keep a short log for this work. Include the vendor identifier, invoice reference, the time the request arrived, the person handling it, the trusted contact source, callback outcome, separate approver, record-update check, and payment status. Point to restricted documents where needed. Keep banking information and passwords out of a general support ticket.

A supplier contact who can't be reached leaves the change unresolved. Escalate it to the owner or finance lead you've named in the procedure. Write down the next action and keep the hold visible, so another employee doesn't assume the change is ready to use.

If money has already gone to a suspected fraudulent account, contact your financial institution immediately. Ask its fraud team about a recall and coordination with the receiving institution. File a report with the FBI's Internet Crime Complaint Center promptly, and preserve the messages and payment records. Recovery depends on the circumstances, so act quickly without assuming the money can be returned.

Your IT provider has work to do alongside the finance team. If an email account may be involved, have the authorized team check access and forwarding rules under your incident plan. Account security and staff reporting support the payment process. Your business still needs named people who verify and authorize banking changes.

Start with one practical check today: find the written procedure your staff use when a supplier changes its bank details, and confirm that the trusted contact and backup approver are current.

For help reviewing business email protection and IT responsibilities in Bakersfield or Kern County, contact Second Star Technologies. Keep financial records out of the first inquiry. We'll discuss the systems and service scope your business needs.

References

Federal Bureau of Investigation. (n.d.). Business email compromise. https://www.fbi.gov/how-we-can-help-you/common-frauds-and-scams/business-email-compromise

Federal Bureau of Investigation, Internet Crime Complaint Center. (2024, September 11). Business email compromise: The $55 billion scam. https://www.ic3.gov/PSA/2024/PSA240911

Federal Trade Commission. (n.d.). Scams and your small business: A guide for business. https://www.ftc.gov/business-guidance/resources/scams-your-small-business-guide-business

Nacha. (2024). Response action plan: Business email compromise. https://www.nacha.org/system/files/2024-07/Business%20Email%20Compromise%20Action%20Plan.pdf

Vendor Bank Details Changed? A Payment Verification Checklist

Brandon Phipps