Supplier Changed Bank Details? What Accounts Payable Should Verify Before Paying
Published August 2026 by Solarc Labs
A genuine-looking invoice can still carry fraudulent payment instructions
Payment-diversion fraud often succeeds because the supplier, invoice history and amount can all look familiar while only the destination bank account has changed. UK business fraud guidance specifically flags requests to change bank details and says payment requests should be verified before money is sent. The National Crime Agency likewise tells businesses to check changes to invoice or bank details and verify with the genuine supplier before transferring funds. The safest operational response is therefore not “does this invoice look real?” but “has this payment destination change been independently verified?”
Do not verify a suspicious change by replying to the same message
If the mailbox or conversation has been compromised, replying to the email that announced the new bank details only asks the attacker to confirm their own instruction. Business.gov.uk recommends phoning a trusted contact at the organisation requesting payment and explicitly warns against relying on the same email or message for verification. Use a phone number or contact route already held in your supplier master data, previous verified correspondence or the supplier’s independently located official channel. Do not use a new phone number supplied inside the bank-change request as the only verification path.
Freeze the payment and supplier-master change until the control is complete
The bank-detail change should have its own review state. Record the supplier, old details, proposed new details, source of the request, verification contact, verification result, reviewer and approval. If the normal process requires two-person approval or another segregation-of-duties control, preserve it even when the request is marked urgent. Urgency is not evidence. A deadline, executive name or threat of late-payment consequence should not bypass the payment-control process.
Cross-check the invoice, but keep invoice validity separate from bank-account validity
A real outstanding invoice does not prove that a newly supplied bank account belongs to the supplier. Compare the invoice number, amount, purchase/order evidence and supplier identity with previously verified records, but treat those checks as separate from confirming the destination account. If the invoice itself has an amount, VAT or duplicate discrepancy, resolve that exception as a second review track. Do not let a clean invoice extraction or a familiar PDF silently approve a bank-detail change.
Preserve an audit trail that explains why the payment destination was accepted
Keep the original request, the invoice, the trusted contact path used for verification, the result of the call or independent confirmation, the approving reviewer and the supplier-master change event linked together. That record helps a later reviewer distinguish “the request arrived” from “the new account was independently verified and approved.” If verification fails or the supplier denies the request, stop the payment and follow the organisation’s fraud-response process rather than trying to resolve the discrepancy inside the suspicious email thread.
InvoiceGuard can support invoice review, but it cannot authenticate a bank-account change for you
InvoiceGuard is bounded to source-invoice review, extracted-field verification, deterministic exception flags and an explicit human decision. It does not prove ownership of a bank account, telephone a supplier, authorize a supplier-master update, guarantee fraud prevention or release a payment. Use the invoice evidence to focus the review, then keep the bank-change verification and payment authorization in the finance controls that own those decisions.
Primary sources
Sources used for this article
Continue the job