How do I verify a vendor’s request to change bank account details?

The FBI’s Internet Crime Complaint Center groups these schemes under business email compromise. Its 2025 annual report counts 24,768 business email compromise complaints with about $3.05 billion in reported losses, most of it sent by wire transfer. Those are only the losses people reported to the FBI.

• Timing. The request lands days before a large or overdue invoice is paid.
• Account name. The new account is in a person’s name or a different company name.
• Location. The new bank is in a different state or country from the vendor.
• Pressure. “Audit in progress”, “old account frozen”, “please do not call, our phones are down”.
• Channel. The request asks you to reply only by email, or gives a new phone number.
• Small differences. A sender domain, signature or invoice layout that is nearly, but not exactly, the usual one.

1. 1

   Stop the change at intake

   Do not edit the vendor record from the request. Log it (who sent it, how, when, the old and new details) and hold the vendor’s unpaid bills from the next payment run.
2. 2

   Find a contact you already trusted

   Use a phone number from the signed contract, the original vendor onboarding form or a past call, never one printed on the request, in the email signature or on a new letterhead.
3. 3

   Call back and ask specific questions

   Ask the person you reach to confirm the request, the reason for the change, the last four digits of the old account and the new account details. Write down who you spoke to and when.
4. 4

   Ask for evidence from the vendor’s bank side

   For larger vendors, ask for a bank letter or a voided check on the new account, in the vendor’s legal name. Treat it as supporting evidence: documents can be forged, so it does not replace the call-back.
5. 5

   Have a second person approve the change

   Someone other than the caller and other than the person who received the request reviews the call notes and updates the vendor record. Keep the old details on file.
6. 6

   Tell the vendor through the old channel

   Send a confirmation to the vendor’s previous email address or main contact. A real vendor ignores it; a vendor whose email was hijacked will reply that they never asked.
7. 7

   Watch the first payment

   Pay a small first amount or the next normal bill only, and ask the vendor to confirm receipt before releasing anything large to the new account.

1. Your bank, immediately. Ask it to recall the payment and contact the receiving bank.
2. Report it. In the US, file a complaint with the FBI at ic3.gov; your bank may ask for the complaint.
3. The real vendor. Confirm the invoice is still unpaid and warn them their mailbox may be compromised.
4. Other vendors. Check whether any other vendor’s details changed in the same period.
5. The gap. Fix the control that let the change through: who could edit the vendor record, and whether anyone called back.

While a change is open, the vendor’s invoices cannot be approved or synced to your accounting system. A user calls the vendor on a contact you held before the change and records the outcome; a second person, who is neither the caller nor whoever triggered the change, approves it. Every step goes to the audit trail. Bank-change checks are included on every plan; see vendor onboarding and bank-change checks.