Verify Changed Bank Details in an Invoice

Before paying an invoice with changed bank details, confirm the change through an established contact method that does not come from the change request. A familiar logo, correct invoice amount, or genuine-looking email thread is not enough. Keep the payment on hold until the authorized vendor change process is complete.

This is a payment-instruction verification task, not a general document-authenticity check. The invoice can contain real goods, accurate dates, and a convincing signature while still directing money to the wrong account. Your workflow should therefore verify the beneficiary change independently from the rest of the invoice.

Recognize the change that needs verification

Look for a new account number, beneficiary name, routing information, payment portal, or instruction to use another entity. A change can appear in the invoice itself, an email attachment, a footnote, or a follow-up message. Treat all of those as part of the payment instruction.

Watch for requests to bypass the established process. “The finance manager is unavailable,” “this must be paid today,” or “do not call the old number” may have legitimate explanations, but they should not remove the verification requirement. Urgency is a business fact to record, not an authentication method.

Do not assume a familiar conversation thread is safe. An attacker may exploit a compromised account or imitate a supplier conversation. The person approving the change should use evidence outside the unverified request to establish who is asking.

Pause the payment and preserve the request

Mark the payment as pending verification in the system that controls its release. If another staff member can pay the invoice, tell the responsible finance owner about the hold. Leaving a note in your personal inbox does not reliably stop the wider workflow.

Keep the invoice version, request message, and existing vendor record available. Avoid replacing the old account details immediately. You need to compare the proposed change against the established information and preserve what the requester supplied.

Do not send bank details to a broad team for informal checking. Limit the review to the people authorized to verify vendors and approve payments. Finance records and investigation notes can themselves be sensitive.

If the invoice is due soon, communicate the verification blocker through the normal business owner. Ask for an approved payment-plan decision if necessary. Do not let lateness pressure make the verifier and payer the same person without the controls your policy requires.

The hold should be visible and reversible once evidence is complete. It is not a declaration that the supplier committed fraud. Use neutral language such as “bank change awaiting verification” until the facts support a different conclusion.

Use an independent contact route

Use the phone number or contact method already established in the vendor record or a independently verified source. Do not use the number printed on the changed invoice as the only basis for the callback. The FBI recommends independent confirmation for payment changes. FBI: Business email compromise

Ask for the appropriate authorized finance contact. Confirm the proposed beneficiary change, when it takes effect, and which transactions it covers. A general receptionist confirming that the supplier exists does not approve the account change.

If your established contact directs you to someone new, verify that handoff through the known organization. Do not treat a new address supplied only in the suspicious thread as independent evidence. Use your existing vendor-change procedure to resolve the new contact’s authority.

Avoid reading complete confidential account details to an unknown caller who unexpectedly contacts you. Instead, initiate the verification using the known route and follow the process agreed by your finance team. Keep authentication evidence separate from the requester’s claim.

If you cannot reach a trusted contact, leave the payment held. Repeated attempts do not improve the authenticity of an unanswered request. Escalate to the finance owner and procurement contact who can establish the supplier relationship.

Approve the vendor change separately from the payment

Treat bank-detail maintenance as a controlled change to the vendor record. The invoice approval confirms that the business owes the amount; the bank-change approval confirms where payment should go. Combining those two questions creates an avoidable gap.

Your procedure may require a second authorized reviewer. Define what they check instead of asking them to click approve after the first reviewer has done all the work. They should see the proposed change, the independent confirmation, and any unresolved mismatch.

Check the effective date and scope. A legitimate supplier may change one account for one currency or entity while leaving other payment routes unchanged. Do not overwrite every vendor record because one invoice mentions a new bank.

Some jurisdictions and banks offer beneficiary checks. Use the facilities available through your banking relationship, but do not treat a name match as proof of every element of the transaction. Equally, an unexpected mismatch deserves review rather than a guess about why it occurred.

A fictional example: a changed supplier account

A fictional agency receives an invoice for an agreed project. The amount and purchase order match, but a note says the supplier has changed banks. A follow-up email asks the agency to call a new mobile number for confirmation.

The accounts reviewer places a payment hold and keeps the invoice and request linked to the case. They call the finance contact already held in the vendor record, using that established number. The known contact says the supplier did not request the bank change and asks for the message reference through the approved route.

The agency escalates to its finance and security owners. It does not forward the disputed invoice to every project participant. The original approved supplier details remain intact, and the payment is released only after the legitimate invoice route is confirmed under the agency’s procedure.

In an alternate legitimate version of this example, the established contact confirms the change and provides the evidence required by the vendor-maintenance process. A second reviewer approves the scoped account update, and the payer uses the approved record instead of manually copying details from the email.

These examples are fictional. They show that the same verification process can reject a fraudulent instruction or approve a real change. The control should be routine enough that legitimate suppliers expect it, rather than a one-off test applied only when somebody feels suspicious.

If money has already been sent

Contact your bank immediately through its established fraud or payment-support route and explain the suspected wrong-beneficiary payment. Provide the transaction reference and follow its instructions. Speed can matter, but do not promise recovery or describe a recall request as a completed reversal.

Notify the organization’s finance and incident contacts. Preserve the invoice, messages, approval history, and payment reference in the approved location. Do not edit the vendor record to conceal the erroneous instruction before the response team has the necessary evidence.

The appropriate reporting route depends on jurisdiction and circumstances. The FBI identifies IC3 as a US reporting channel for business email compromise. FBI Internet Crime Complaint Center Use the relevant local authority and organizational procedure where applicable; this article does not prescribe a universal reporting destination.

Avoid confronting the suspected sender through the same thread while responders are assessing the case. The team may need to coordinate vendor contact, account-security review, and banking communications. Accurate facts help more than accusations based on incomplete information.

Make verification part of ordinary finance work

Tell suppliers in advance that changes to payment details require independent confirmation. Put the process in the vendor onboarding materials and assign an owner to maintain the trusted contact record. A callback process fails if the number was never verified or is no longer current.

Keep the verification log brief but actionable: old record reference, requested change, established contact used, confirmation time, approving reviewer, and effective scope. Do not record unnecessary personal information merely to make the file look complete.

Review failures in the workflow. If staff pay directly from attachments, route them back to approved vendor records. If approvals are rushed, make the payment hold and escalation path clearer. Training should explain why the control exists and show that accurate invoice content can coexist with a false bank instruction.

Never use a small test transfer as the sole authenticity check. Receiving money at an account shows that the account accepts the transfer, not that the beneficiary change was authorized. The independent identity and approval process remains the central control.

During a periodic review, sample recent beneficiary changes and check that the stored evidence identifies the independent route used. If the log only says “confirmed by email,” ask whether that email belonged to the original unverified conversation or a separately established contact. The distinction changes the strength of the confirmation.

Keep vendor contact maintenance separate from bank maintenance where practical. Otherwise, the same disputed request could replace both the account number and the number used to verify it. A reliable process checks the authority for each change instead of allowing one unverified message to redefine the trusted record.

Frequently asked questions

Can I verify using the phone number on the new invoice?+

Do not rely on that number alone. Use a contact route established independently of the change request.

Does an accurate purchase order prove the bank details are genuine?+

No. Authentic transaction details can appear alongside altered payment instructions. Verify the beneficiary change separately.

Will my bank recover an erroneous transfer?+

Recovery is not guaranteed. Contact the bank promptly through its official route and follow its instructions.

Before you proceed

Verify the changed beneficiary through a known independent contact, approve the record change, and release payment from the approved record. A convincing invoice should not be allowed to bypass that sequence.

Parent guide

• Check Whether a Document Request Is Genuine

Related articles

• Check Whether a Document Request Is Genuine

• Spot Fake Document-Signing Requests

• Send Bank Statements for a Rental Application Safely

Sources and editorial disclosure

Primary documentation reviewed October 13, 2026. Worked examples are fictional illustrations. Checklists and decision frameworks are editorial recommendations; product-specific facts are linked to official documentation. These guides do not claim that signed-in product tests or customer projects were performed.

• FBI: Business email compromise

• FBI Internet Crime Complaint Center

VDR Directory is published by the team behind SendNow. This ownership is relevant when evaluating any product mention. Stock photos illustrate general context; they do not demonstrate software features or identify actual affected people. Controls and tool availability depend on the provider, edition, version, device and configuration. No guide guarantees confidentiality, regulatory compliance, acceptance of altered documents, or search rankings.