How-to
How do I safely handle a vendor that changed their bank details?
By Tim White · Last updated
Treat any change to a vendor's bank details as unverified until you confirm it through a channel you already trust. A request to update payment information, even on what looks like a real invoice or email, is the core of business email compromise. Phone a known contact at the vendor using a number you already have, not one from the request, confirm the change, and only then update your records. This one habit stops most redirected-payment fraud.
1. Pause the payment
Do not update the details or release a payment on the strength of an email or a note printed on an invoice. A change of bank details is exactly the moment fraud tries to slip through, so slow down.
2. Verify out of band
Call the vendor on a number you already hold from earlier dealings, never a number in the request itself. Confirm the change with a person. An imposter can copy branding, signatures, and invoice layout, but cannot answer your known contact's phone.
3. Update and document after confirming
Once confirmed, record who you spoke to and when, then change the details. InvoiceJet keeps an approval record on each invoice, so the payment has a trail, but the bank-detail verification itself is a process step you own.
Common questions
The email looks completely legitimate. Is that enough?
No. Imposters copy branding and signatures convincingly. Verify by phone to a contact you already know before changing anything.
Where does this kind of fraud usually start?
A spoofed or compromised email posing as a known vendor, asking you to redirect payment to a new account.
Sources
Keep reading
Turn your next invoice into verified data
Free for 10 invoices a month, no card. Every field carries a confidence level and cites its source.