Verify Supplier Bank-Account Change Emails Before Updating Records
Familiar-looking requests still need a process
An email requesting new payment details may use a familiar supplier name and refer to an invoice nearing its due date. Establish a specific checking process for these requests. Urgency or an existing email thread should not justify skipping verification. The objective is to confirm that an authorized supplier representative genuinely requested the change before the new details are used.
Verify through a channel independent of the request
The FBI advises verifying changes to account numbers or payment procedures and not relying on contact numbers supplied by a suspicious sender to authenticate the request itself. Use previously verified supplier contact details or independently locate an official channel. If contact cannot be made or answers differ, hold the request for review under the procedure rather than treating a reply in the same email thread as successful verification.
Separate receipt, checking and approval
Define who receives documents, who verifies the request and who approves changes to the vendor record, according to team size. Reviewers should see old and new details, the reason and the requested effective date. Do not forward only a cropped account-number image. Small teams should identify an appropriate reviewer and an absence procedure, so urgent requests do not change the process without an accountable owner.
Ensure payment systems use approved information
Record separate statuses for awaiting documents, awaiting verification, approved and rejected. Do not replace the old details as soon as a request arrives. For example, if two invoices remain unpaid and a supplier specifies a start date for the new account, confirm which invoices are affected before updating records. Preserve the editor, timestamp and supporting evidence so departments do not apply different interpretations.
Rehearse unusual situations
Ask staff how they would handle requests to communicate only by email, to change both contact number and bank details, or to rush payment on a manager's authority. Establish escalation contacts in security and finance beforehand. If a payment may already have gone to the wrong destination, promptly contact the bank through an official channel and coordinate with the response team. Preserve the original email; do not delete it or share sensitive details with unrelated groups.
Connect IT controls with accounting work
Chawinnix provides IT security and business systems services. Use this workflow to discuss permissions for editing vendor records, alerts and approval logs appropriate to the existing system. MFA helps protect accounts but does not replace verification that a business request is genuinely approved. A useful process must work on busy days and support later review, without promising to prevent every fraud.
