Bank Detail Verification

An invoice arrives with a new account number, and the sender may be a real supplier or someone who altered an email or document, since a familiar logo and signature do not prove the new destination belongs to the supplier. Action Fraud describes payment diversion fraud in which criminals impersonate a known supplier and redirect payments, and advises checking changes with a trusted contact using details from another source, a control that is useful regardless of the payment amount.

A business should establish a verified contact when a supplier is first onboarded, record the number or other approved route in a controlled supplier master, and never use the telephone number in a suspicious change request as its own verification. In a fictional example, an accounts clerk receives a bank-change email from a supplier name they recognise, calls the previously recorded switchboard and asks for the approved contact.

The supplier says no change was requested, so the clerk stops the payment and escalates. Verification should confirm the payee identity and the specific new bank details, because a call that merely asks whether 'the invoice is genuine' can miss an altered account number, so the account identifiers should be read back through the trusted route.

A callback is one control, not a guarantee against every fraud, since contact records may be stale and a compromised internal process can still fail, so review who created and who approved the vendor change. Segregation of duties can keep the person editing bank details from solely releasing the payment, with a second reviewer seeing the verification record, and small teams may need alternative controls such as owner review.

Payroll changes also need care, because a message claiming to be from an employee may arrive from an unfamiliar address or compromised account, so follow the employer's trusted identity process rather than treating the message alone as proof. Do not put full account numbers in casual chat or broad email threads; limit access to the payment system and keep an audit log, noting that privacy and security requirements vary by jurisdiction.

A bank account name-checking service may provide another signal where available, though it may not validate authority to change a supplier record, so match the service result with independent contact verification. Urgency is a reason to slow down, not bypass a control, because a request to pay immediately to a new account creates a high-risk combination that should be escalated before sending funds, even though a change can be legitimate when suppliers merge, change banks or update legal entities.

In a second fictional example, a hotel chain receives a changed payroll file before payday, checks the employee's request through its established HR workflow, and does not email the supplied account number back to a personal address to seek confirmation. Document the date, verifier, contact route, exact fields checked and approver rather than a generic 'verified' tick, so that a later review can reconstruct why the change was accepted.

Verification can be measured as the share of bank changes with complete independent checks, but controls should be tested for quality, because one skipped high-value change can matter more than many routine passes. Payee master records should be reviewed for duplicates and unused accounts, and old bank details deactivated according to policy, since a dormant alternate destination can otherwise remain a risk.

If a payment already went to a questionable account, contact the sending bank immediately through an established channel and follow local fraud-reporting procedures, because quick action may help but recovery is not assured. Training should use examples of lookalike addresses, altered invoices and compromised threads, and staff should know they will not be punished for pausing a suspicious payment, since bank detail verification protects the last mile of a payment by confirming the person, the request and the exact account through independent evidence before the destination changes.