Supplier Bank Detail Changes: How to Stop a Payment Going to a Fraudster

Nevada Academic Team 7 min read

Key takeaways

Treat every request to change a supplier's bank details as a high-risk event that is actioned only after verification through an independent channel and approval by a second person.
Proper verification means calling a number you already hold on file, not the number or link in the message itself, however familiar the email looks.
If the payment has gone, time is critical: contact your bank immediately to request a stop or recall, preserve the evidence and notify your security team and the relevant authorities.

This article is for professional awareness of payment controls and does not replace your organisation's policies, your bank's procedures or the instructions of the competent authorities in your country.

Why is a supplier bank detail change the highest-risk moment?

Business email compromise, also called email account compromise, targets organisations that make legitimate funds transfers, and often relies on compromising genuine email accounts through social engineering or computer intrusion. ^[1] The FBI observes that the criminals’ aim is to alter payment instructions for vendor services or employees’ payroll details. ^[2]

The scale is not marginal. IC3 recorded exposed losses of more than USD 55 billion across 305,033 incidents between October 2013 and December 2023, and listed the UAE among the countries whose banks served as intermediate destinations for diverted funds in 2023. ^[1] Accounts payable cannot therefore treat a bank detail change request as a routine admin update.

Which warning signs should make you stop before any change?

The request may come from the supplier’s genuine account after it has been compromised, or from a lookalike address that is hard to spot, and a fraudster may forward an old, genuine email with the bank details changed. ^[4] Warning signs in the official guidance include: ^{[2, 4]}

Unexplained urgency to pay, or last-minute changes to wire instructions.
A sender address that differs slightly from the usual one: an extra character, a different domain, or a personal address instead of a work one.
A request to move the conversation to another channel, or writing that does not sound like the usual sender.
A request for an advance payment that was not previously required.

An employee reading an email on a laptop — A familiar-looking message does not prove the account change request really came from the supplier.

How do you verify the request through an independent channel?

The rule that recurs in all the guidance is the same: verify any change to account information through a second channel. ^[1] The FBI advises verifying payment changes in person or via a known telephone number, contacting the supplier on the number held on file rather than one given in the message, and never making account changes through links in an email. ^[2]

Ireland’s National Cyber Security Centre suggests keeping a supplier list with verified contact points, and says a “quick update to bank details” should always trigger a phone call. ^[3] In practice, record in the supplier file the name and role of the person who confirmed the change, the number used and the time of the call, and ask them to confirm details that do not appear in the message.

Bear in mind that a change to the contact details themselves can be a preparatory step: the guidance advises scrutinising any change to communication platforms or email addresses, and unsolicited requests to verify account information. ^[2] Treat a request to update a supplier’s registered phone number or email with the same care, and never use the new details to verify a bank change that arrives straight afterwards.

Who enters the change and who approves it?

Verification alone is not enough if the same person receives the request, edits the supplier record and approves the payment. Separate these roles wherever team size allows, and make any change to supplier data require approval by a second person who reviews the verification evidence, not just the request.

Control points for a supplier bank detail change

Control point	What you do	Evidence kept
Request received	Log it, freeze any immediate change	Original email with headers
Verification	Call a number already on file	Name of confirmer, time of call
Entering the change	Someone who does not prepare payments	System change log
Approval	Second person reviews the evidence	Documented approval
First payment	Extra review before release	Supplier confirms receipt

A practical template prepared for this article; adapt it to your finance system and authority limits.

The guidance recommends dual approval for financial transactions above a set threshold, delaying large payments by default to allow time for fraud checks, and using payment systems that flag unusual changes to payee data and are kept separate from email where possible. ^[3] The NI Cyber Security Centre also advises multi-layer authorisation for payments and regular review of bank statements by the finance team. ^[4]

What should the written procedure cover?

The FBI recommends policies requiring verification of any change to invoices, bank routing information or contact information. ^[2] To make the procedure workable and auditable, it should set out:

Scope: every change to bank account, beneficiary name or contact details, whatever the source of the request or the value of payments.
The approved verification channel, who carries out the check and who may not.
The value threshold that requires dual approval or a payment delay.
The urgent exception route and who may approve it.
Where verification evidence is kept and for how long.

Which email controls reduce the opportunity for attack?

Part of prevention is technical and sits with IT. The FBI recommends multi-factor authentication on all email accounts, blocking automatic forwarding to external addresses, monitoring custom rules added to mailboxes, banners on emails from outside the organisation, and configuring SPF, DKIM and DMARC to limit domain spoofing. ^[2]

An employee making a phone call from the office — Calling a number already held in the supplier file is the core of independent verification.

Hypothetical example: a message in a familiar thread

Hypothetical example: an accounts payable officer at a distribution company receives a message in a genuine email thread with a regular supplier, asking for a payment due this week to be sent to a new account “because of a bank review”, with an attached letter bearing the supplier’s logo and a phone number for confirmation.

The officer does not call the number on the letter but the one held in the supplier file since onboarding, and the supplier’s finance manager confirms they sent no such request. The officer saves the email with its headers, freezes the change and alerts the security team, which finds that the supplier’s own account has been compromised and lets the supplier know. The payment is made on time to the old, verified account.

What should you do if a payment has gone to a fraudulent account?

Time is critical. Contact your bank immediately and ask for the transfer to be stopped or recalled; bank policies differ, so ask what help they can give. ^[1] Ireland’s National Cyber Security Centre warns that most funds cannot be recovered if they are not flagged within the first few hours. ^[3]

If a payment has gone to a suspicious account

1Call the bankRequest an immediate stop or recall
2Alert securityIT and security team
3Preserve evidenceEmails, headers and transfer records
4Close the gapPasswords and forwarding rules
5Report itPolice or competent local authority
6Review the procedureUpdate controls and training

A sequence based on IC3 and Ireland's National Cyber Security Centre guidance; speed at the first step matters most.

Do not delete any message or record; keep email headers, logs and transaction details, change compromised passwords and check mailbox forwarding rules. ^{[3, 4]} Then report the incident to the police or the authority responsible for cybercrime in your country, following its procedures.

In the UAE, for example, the official government portal lists the Ministry of Interior’s eCrimes platform in its app, the Dubai Police eCrime service and Abu Dhabi Police’s Aman service, as well as reporting at the nearest police station or by calling 999. ^[5] Elsewhere in the GCC, confirm the official channel in your country in advance and write it into the procedure, so that no time is lost looking for it during an incident.

How do you apply the procedure in Gulf organisations?

Set a written route for urgent cases during public holidays, rota cover and the financial year-end, when fewer approvers are available and pressure is higher. If you are a government or semi-government body, remember that the FBI considers published information about officials, suppliers and contracts helpful to fraudsters in crafting convincing messages, ^[2] so tighten verification after tenders are awarded and contracts announced. Agree in advance with your bank the channel for urgent reporting of a suspicious transfer and who in your organisation may use it.

When onboarding a new supplier, record at least two contacts for verifying bank details, and agree with them that no change will be accepted until you have called. Test the procedure periodically with a training scenario on dummy records to see whether the team can stop the payment and escalate.

Conclusion

A supplier bank detail change is not a minor admin edit but a control point that deserves a written procedure. Verify through a number already on file, separate the person who edits from the person who approves, and set up the rapid response route with your bank before you need it.

Frequently asked questions

Is it enough that the request came from the supplier's usual email address?

No. The supplier's genuine account may have been compromised, and a fraudster may forward an old, genuine email with the bank details altered, so independent verification is still needed. [2, 4]

Should I call the number in the email or on the attached supplier letter?

No. Call a number held in the supplier file before the request arrived, or a channel you have verified previously, because the number in the request may belong to the fraudster. [2, 3]

What if the payment is urgent and the supplier is not answering?

Unexplained urgency is itself a warning sign. [2] Pay to the old, verified account if possible or defer the payment, and do not skip verification under pressure.

What is the first step if we discover a payment went to a fraudulent account?

Call your bank immediately, ask for the transfer to be stopped or recalled and escalate to its fraud team; the chance of recovery drops sharply if the payment is not flagged within the first few hours. [1, 3]

Is staff training alone enough to prevent this fraud?

Training is essential but not sufficient on its own; it needs a written procedure for verifying bank detail changes, dual approval of payments and technical email controls such as multi-factor authentication. [2, 3]