How do I safely handle a vendor that changed their bank details?
By Tim White · How-to · Last updated
Treat any change to a vendor's bank details as unverified until you confirm it by phone, using a number you already had before the request arrived. Change-of-account requests are the core of vendor impersonation fraud, and they often look genuine. A call-back rule with no exceptions stops most of it.
1. Pause
Don't update the vendor record or release a payment on the strength of an email, a letter or a note printed on an invoice. A bank change is exactly when fraud tries to get through, so slow down even if the request is marked urgent.
2. Call a number you already have
Use the phone number from your vendor file, an old invoice or the vendor's website, never one in the request. Ask your usual contact to confirm the new account details aloud. A scammer can copy a logo, a signature and an invoice layout. They can't answer your contact's real phone.
3. Record it, then change it
Note who you spoke to, when and what they confirmed. Then update the details. For the first payment to the new account, consider a small test amount or confirming receipt with the vendor before sending the full balance.
Red flags
Urgency. An email address one character off the real one. 'Our usual accounts person has left.' A request timed to arrive just before a large invoice is due. A request that seems to come from your own owner or director asking you to skip the usual steps.
Write the call-back rule down and apply it to everyone, so a busy afternoon can't talk you out of it. InvoiceJet doesn't verify bank details. This check is yours.
Common questions
The email looks completely legitimate. Is that enough?
No. If the vendor's email was hacked, the request will come from the real address. Call to confirm.
What if the vendor really did change banks?
Then the call confirms it in two minutes. A genuine change survives a call-back. Only fraud needs you to skip it.
Sources
Keep reading
Try it on your own invoices
10 invoices a month free, no card. Every field comes back with a confidence level and the text it was read from.