Free vendor bank change request checker

A fake vendor bank change request is a common way payments are diverted: the email looks real, and the next payment goes to a fraudster. Tick the warning signs on the request in front of you to get a risk level, the steps to verify it and a verification log for the vendor file. The checker never asks for bank details and runs in your browser. Whatever the level, every change needs a call-back to a contact you already trust.

Updated November 13, 2026 · Aequo editorial team

Check the request

How did the request arrive?

EmailNew bank details printed on an invoicePhone call from the vendorLetter or PDF on letterheadVendor portal with its own loginIn person, from someone you know

Tick every sign that applies

The sender’s email domain differs from the vendor’s usual one, even by one characterReplies go to a different address than the one it was sent fromIt arrived as a reply in a real, earlier email threadIt asks for the change before a payment due now, or says it is urgentIt asks you not to call, or says the usual contact is unavailableIt comes from someone at the vendor you have not dealt with beforeThe same request also changes the phone number or email on fileThe account holder name does not match the vendor’s legal nameThe new bank is in a different country or state than the vendorThe new account looks personal or is at an online-only bank the vendor has not usedLarge invoices for this vendor are due in the next two weeksThe vendor was set up in the last 90 daysThe reason given is vague, such as an audit, a bank merger or tax issues

What has been done so far?

Someone called the vendor on a number you held before the request arrived, and they confirmed itA second person, not the one who took the request, reviewed and approved the changeThe vendor sent a bank letter or voided check that you confirmed on that call

Risk level

Low

Few warning signs, but every bank change still needs a call-back.

What to do next

Do not change the bank details or release any payment to the new account yet.
Call the vendor on a phone number you had before this request: the vendor master file, an old invoice or contract. Never use a number, email or link that came with the request.
Ask the contact to confirm the change, the new account holder name and the last digits of the new account, without reading them out first yourself.
Have a second person, who did not take the request, approve the change before it is saved.
After the first payment to the new account, ask the vendor to confirm they received it.
Send a notice to the vendor’s previous email address on file, so a real vendor learns about a change they did not ask for.

This checklist does not ask for bank details and cannot tell whether an account is genuine. Only a call to a contact you already trust can confirm a change.

A bank-change policy in five rules

Written down and applied to every vendor, these five rules close the gaps payment diversion relies on.

No change from email alone. An email, letter or invoice can start a change but never completes one.
Call back on a number you already had. Never one that came with the request.
Two people. The person who takes the request is not the person who approves it.
Change contacts separately. A request that changes the bank and the phone number together is verified twice, on the old number.
Confirm the first payment. Ask the vendor to confirm they received it, and review all bank changes at month-end.

The month-end close checklist generator includes the monthly review of vendor bank changes as a standard step.

Aequo AP

Hold the vendor automatically when bank details change

Aequo AP compares the bank details printed on each incoming invoice with the details you trust for that vendor, and reads supplier bank details on every Xero sync. It also flags emails to your Aequo inbox asking to change a vendor’s bank details, including lookalike sender domains. When details change, the vendor’s invoices are held from approval and sync until someone records a call-back to a known contact and a second person approves the change.

Aequo AP does not confirm with a bank that an account belongs to the vendor, and it does not pay vendors. The control is the hold, the call-back and the second approver. How bank-change holds work.

Start free trial Book a walkthrough →

Frequently asked questions

How do I verify a vendor bank account change?

Call the vendor on a phone number you already had before the request arrived, from the vendor file, an old invoice or the contract. Ask them to confirm the change and the new account holder name without reading the details to them first. Then have a second person approve the change before it is saved, and confirm the first payment to the new account arrived.

Why not reply to the email to confirm?

If the vendor’s mailbox is compromised or the domain is a lookalike, your reply goes to the fraudster, who will confirm the change. The same goes for any phone number, link or contact in the request itself. Only a contact you held before the request is independent.

Is a low risk level safe to approve?

No. The level tells you how many warning signs you ticked, not whether the request is genuine. A well-crafted fake shows none of them. Every bank-detail change still needs a call-back to a known contact and a second approver.

What is vendor email compromise?

Vendor email compromise is a kind of business email compromise in which a fraudster takes over or imitates a real vendor’s email and asks you to send payments to a new account. Because it often replies inside a genuine email thread, it can look entirely normal.

What if we already paid the new account?

Call your bank straight away and ask them to recall the payment; speed matters. Then tell the real vendor using a contact you trust, preserve the emails, and report it. In the US you can file a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov.

Does this tool see my bank details?

No. It never asks for account numbers or names, and it runs in your browser from the boxes you tick. Nothing is uploaded or stored, and there is no sign-up.

Related tools and guides

Vendor fraud red flagsThe warning signs across the whole vendor file.
Payment fraud risk assessmentScore your AP payment controls.
Vendor onboarding formCollect bank details the right way at setup.
Positive payA bank control for check fraud.
Bank-change holds in Aequo APHold, call back, second approver, audit.
Month-end close checklist generatorIncludes a monthly bank-change review.
All free toolsTemplates, generators, calculators, tax and construction tools.

Sources

FBI Internet Crime Complaint Center (IC3): report a crime