A supplier changed bank details. What happens next?

Treat a payment change as its own decision

Approving an invoice and approving new payment instructions are different decisions. The business may owe the supplier money while still needing to verify where that money should go. Keep those questions separate so an otherwise valid invoice does not become automatic approval for a new destination.

Write down the kinds of changes that trigger a check: account details, payment method, beneficiary name, destination, or an unusual instruction to bypass the normal process. The list should fit the way your business pays people. Staff should not have to decide whether a change feels suspicious enough to deserve attention.

A fictional U.S. landscaping company might receive legitimate bank changes from seasonal suppliers. A standard rule applied to every change keeps verification predictable and avoids accusing a particular contact of wrongdoing. The staff member can explain that the same process applies whenever payment information changes.

Our security awareness service can use this kind of real workflow as a training topic. The goal is not to turn payment staff into investigators. It is to give them a clear decision boundary and a way to get a properly authorized answer.

Document the routine while the correct people are available to agree it. If the company has several bank accounts or payment methods, state which situations the procedure covers. A staff member should not have to assume that a process written for a wire transfer applies unchanged to every other kind of payment.

Understand why a familiar conversation is not enough

A request may appear in a new message, a reply, or an ongoing conversation. Familiar project details can make it persuasive without establishing who controls the account sending it. Do not make the process depend entirely on spotting misspellings or a strange greeting; those clues may be absent.

The FBI’s business-email-compromise guidance recommends verifying changes in account numbers or payment procedures. Read its current explanation for the broader risk. For your day-to-day process, the practical response is to verify the instruction through a route that does not rely only on the request itself.

Keep the review focused on the action being requested. “Change the destination of next week’s payment” needs confirmation whether the message looks polished or not. A payment deadline, friendly tone, or copied manager is context to consider, not evidence that the new instructions are authorized.

The unexpected-message checklist explains the same separation for personal requests. At work, it belongs inside a payment procedure with named responsibilities, rather than being left as informal advice that each employee interprets differently.

Use contact details you already trust

Choose the verification route from the business’s established records. A phone number newly supplied in the bank-change email should not become the only number used to confirm it. The independent step loses its value if every detail comes from the same potentially unreliable request.

Identify which record is the approved source: a vendor master record, previously verified contract contact, or another documented business system. Then establish who can change that record. A process that trusts the directory blindly is weak if the directory can be edited based on the unverified message being checked.

IC3’s business-email-compromise guidance recommends secondary channels to verify account-information changes. Use that principle to design a route staff can actually follow. Do not treat one successful-looking callback as complete proof if the route itself was never independently established.

Keep alternative contact arrangements for cases when the usual contact is unavailable. The alternative should be agreed in advance or established through an appropriate business process. It should not be improvised by accepting a new number from someone who insists that the usual person is traveling and cannot be reached.

Confirm the change without oversharing

When contacting the supplier through the established route, explain that your company verifies payment changes routinely. Confirm that the authorized person requested a change and use your approved method for handling the necessary details. Avoid reading private financial information to an unverified recipient as a way of asking whether they recognize it.

A short opening can be enough: your team received a request to update payment instructions, and you are confirming it through the contact information already on file. Keep the conversation about the specific change, not about whether the sender’s email “looks like a scam.” That makes the process calmer for legitimate suppliers.

If the contact cannot confirm, does not know about the change, or asks you to use a different route, pause the update and follow the escalation process. Staff should know which person can decide the next step. A confusing conversation is not permission to choose the answer that gets the invoice off the desk fastest.

When the business exchanges documents during verification, use appropriate access controls. The shared-document guide explains why sending an unrestricted folder can expose far more than a single form requires. Do not create a new privacy problem while trying to resolve a payment concern.

Separate checking from changing the record

Decide who requests the update, who verifies it, who approves it, and who enters it in the payment system. In a very small company, one person may hold several roles, but the business should still be explicit about the review and approval it can support.

A practical two-person step can help catch an incorrect entry as well as an unverified request. The second person needs meaningful evidence and a clear task, not merely a button to click because someone else appears to have done the work. Define what the reviewer confirms before calling the change approved.

NCUA’s guidance on cloud-email compromise includes verifying payment changes through known contact routes. Its intended audience is financial institutions; your company still needs its own procedure appropriate to its size, roles, and bank arrangements.

Keep the original record and the proposed change distinguishable during review. Avoid replacing the old instructions first and then trying to reconstruct what changed. A reviewable record should show the authorized request, the verification route, and the decision, with access limited to the people who need it.

Make deadlines and absences part of the procedure

The process will face pressure when someone is out sick, an owner is traveling, or a supplier says payment cannot wait. Plan those situations while things are calm. Name an alternate approver and explain which actions remain paused until verification is complete.

Give staff permission to say that the change has not yet passed the required check. Otherwise, a written policy can be undermined by the practical expectation that invoices must always move immediately. Managers should support the pause and resolve genuine operational exceptions through an accountable decision, not through a private instruction to skip the record.

For a small business, this may be a short page rather than a complicated manual. It should still identify what happens outside normal hours and whether a payment can proceed using previously verified instructions. Those decisions depend on the circumstances and should not be improvised by the employee receiving a demanding message.

This is a useful scenario for your business security review brief. Include the systems and people involved in the payment handoff. The technical setup and the approval process need to support the same decision, particularly when email is the main communication route.

Protect the email accounts behind the process

An independent check is important, and the accounts used for payment conversations deserve attention too. Review sign-in protection, recovery settings, delegated access, and any forwarding arrangements through the provider’s official tools. Keep the review authorized and coordinated with whoever administers your company email.

Personal habits can support the business process without replacing it. A unique password and a supported additional sign-in factor help protect accounts; they do not establish that every message in the inbox is genuine. Staff need both account protection and a defined payment-change procedure.

The guides to important email accounts, password managers, and multi-factor recovery planning provide useful background. In a managed business account, follow your organization’s controls and ask the administrator before changing settings that affect others.

If an account is suspected to be compromised, report it through your internal route rather than conducting an unauthorized search through someone else’s mailbox. The responsible team needs to preserve relevant evidence and decide containment. A staff training article should not be used as a substitute for an agreed incident-response process.

Record enough evidence to explain the decision

The record should identify the supplier, the requested change, the verification method, the person who verified it, the approval, and the date the system was updated. Store it where the authorized payment team can find it. Do not put full banking details into a widely shared spreadsheet merely to prove a check occurred.

Be precise about what was confirmed. “Called the number in the email” is different from “used the established vendor contact in our approved record.” “Manager copied on the request” is different from an actual recorded approval. Clear wording helps a future reviewer understand the decision without assuming missing steps happened.

FinCEN’s advisory on email-compromise fraud discusses verification and transaction-related indicators for financial institutions. For an ordinary company, its value here is context for talking with your bank about the controls and reporting routes relevant to your payment arrangements.

Review the procedure with the person who owns company information handling. The business privacy and data protection service can examine agreed workflows, including who receives documents and where records go. Operational evidence should make the process clearer without unnecessarily spreading financial information.

Know what to do if money already moved

If you suspect a payment was redirected, contact your bank or payment provider immediately through its established fraud route. Do not wait for a routine support email response from a security consultant. Explain what happened and follow the provider’s instructions for the transaction and any available response options.

Notify the appropriate internal contact and preserve relevant messages and records without forwarding sensitive information indiscriminately. Reporting options include the FBI’s IC3 route described in the official guidance linked above. A report or bank request does not guarantee recovery, so keep records of the actual response and next actions.

If a supplier’s account may be involved, contact the supplier through the independent route and avoid blaming a particular person before the facts are established. Identify the payment and the concern clearly. The business may need professional help with investigation, legal duties, or communications depending on what happened.

Be cautious of unsolicited offers to recover funds for a fee. The urgency of the situation should not bypass the verification habits you are trying to establish. Our advisory service describes a scoped review and explicitly does not promise fund recovery.

Practice the ordinary situation, not just the obvious scam

Walk through a realistic payment change with the people who perform the work. Include a correct-looking invoice, a familiar sender name, an unavailable approver, and a busy deadline. Ask which record supplies the callback number and who can authorize the update. The useful outcome is finding unclear steps before a real request exposes them.

Keep training respectful. The point is to improve a system, not to embarrass the person who handles the inbox. Ask what makes the approved route difficult during a busy day and fix those obstacles where possible. A procedure becomes more reliable when managers, finance staff, and IT understand the same handoff.

After the walkthrough, write down the changes needed and give them an owner. You might update a vendor contact record, clarify the alternate approver, or simplify the evidence required. Revisit the process when the payment platform, bank arrangements, or responsible staff change.

If you want help framing that work, describe the workflow to Broxme without sending banking credentials or payment files. A clear process does not depend on guessing whether every email looks wrong. It gives the team a steady route for verifying a decision that deserves more than a familiar name.

Keep the final instructions accessible to the team that needs them, with an owner and a date for the next review. A procedure stored in a departed employee’s private folder is difficult to use when the next request arrives. Accessibility here means available to the authorized team, not published with sensitive payment information.