How to check a supplier’s changed bank details before paying

A familiar email can carry false instructions

In business email compromise, criminals impersonate someone involved in a payment to redirect money. They may use a slightly altered email address or gain access to a genuine mailbox. HSBC warns that supplier-payment requests can continue an existing email conversation and fit the business’s real activity. Checking spelling and the full sender address can reveal a problem, but a familiar thread still needs a separate payment check.[3]

Check that your business actually owes the invoice before investigating its replacement bank details. Compare it with the approved order or agreed service. The FTC recommends clear procedures for approving purchases and invoices from vendors a company uses. Keep an unfamiliar invoice out of the payment queue until someone can explain the purchase.[4]

Call through a number saved before the request

Use the supplier contact and phone number already held in your business records. HSBC recommends a known contact on a known number, or a number from the company’s official website. Obtain it independently of the message announcing the change. A phone number in that message, its attachment or its signature could belong to the person attempting the fraud.[3][2]

1. Explain which invoice you are paying and ask whether the supplier requested a bank-account change.
2. Ask your established contact to confirm the account-holder name, full account number or International Bank Account Number (IBAN), bank codes and receiving currency. Compare those details with the new instructions.
3. Ask when the change takes effect and which unpaid invoices it covers. Resolve any difference before updating the saved recipient.
4. Record the date, who confirmed the change and which independently obtained number you called. Keep that record with the invoice.

[2]

You can say: “We received new payment instructions for invoice [number]. I’m calling the contact number we already hold to check them before changing your account in our records.” If you cannot reach an established contact, leave the payment on hold. The FBI advises verifying account-number and payment-procedure changes and taking particular care when someone pressures you to act quickly.[1]

Resolve account-name warnings separately

Ask your payment provider whether it checks the recipient’s account name for this particular route. For example, the UK’s Confirmation of Payee service compares an entered name with the receiving account’s name. Barclays checks new payments through the UK’s Faster Payments and CHAPS systems, as well as new standing orders. For an international transfer, confirm which checks your provider offers on the route you will use.[5][6]

A match helps check the account details you entered. You still need to establish that the supplier authorized the changed instructions and that the invoice is due. If the result is a partial match, no match or unavailable check, contact the supplier through your trusted channel and ask the provider what the warning means. Barclays warns that proceeding with incorrect details can send money to the wrong account, with recovery uncertain.[6][4][9]

Have another person review the change

Where your business has another authorized colleague, ask that person to review the invoice, confirmed details and verification record before payment. FBI guidance recommends considering two-person approval for transfers. Give the reviewer the checked instructions, rather than asking them to approve a forwarded email on its own. Before submitting, compare the recipient shown by your provider with the details your contact confirmed.[7]

If you already sent money, contact your bank immediately

Tell your sending bank or payment provider that you suspect an invoice-payment scam. Give it the transfer reference, amount, currency, date and receiving-account details. Ask whether it can stop the payment or request its return. For suspected business email compromise, IC3 advises contacting the originating financial institution promptly to request a recall or reversal. Ask the institution which supporting documents it needs. A request to recover money does not guarantee its return.[8][9]

Keep the original messages, attachments and transfer confirmation. For a US business, report suspected business email compromise to the FBI’s Internet Crime Complaint Center at IC3.gov. Include transaction details and retain evidence. Outside the United States, contact your bank and the police or fraud-reporting authority responsible for your location. Alert the genuine supplier through your established contact so both businesses can investigate the false instructions.[7]

Plan costs after confirming the recipient

Once you have confirmed the supplier and receiving instructions, use the ForexRates business worksheet to estimate your invoice’s value in your budget currency before provider costs. Our overseas-invoice guide then explains how to agree the amount that must arrive, who pays bank charges and the payment deadline.