Supplier bank changes: verify the request before updating the payee
A hypothetical payment run holds two genuine invoices from a regular supplier, for £7,200 and £4,800. Shortly before release, an email arrives in the existing thread with that supplier. It says the supplier has changed banks and attaches a letter with new account details. The invoices are correct and neither is a duplicate. If the payee record is edited from that email, £7,200 + £4,800 = £12,000 goes to whichever account the message names. That is the value of this run, not an estimate of loss.
Why the change needs independent verification
The FBI's guidance on business email compromise warns that criminals can gain access to legitimate billing conversations. It advises looking up a company's phone number independently rather than using one in a suspicious message, verifying payment requests and changes to account details or procedures directly, and being cautious when pushed to act quickly.
The UK National Cyber Security Centre recommends checking important email requests through a different form of communication and keeping payment processes familiar to staff. It also says users cannot be trained to spot every phishing attempt, and recommends layered technical, process and people defences.
A reply in the same thread is therefore not independent verification, and neither is a convincing letterhead or a familiar signature.
Sources and context, checked :
Verify through a contact you already trust
Our recommended procedure:
- Record the request without editing the live payee record.
- Call an established supplier contact on a number held before the request arrived, such as one in the supplier file or contract, never one taken from the email.
- If that number cannot be trusted, find a channel through the supplier's independently verified company details.
- Confirm through that channel that the supplier authorised the change, and agree the new details there.
- Log who confirmed it, where the number came from, the date and the result.
No shortcut through a test payment
A small test payment to the new account does not replace this. It shows money can reach an account, not who controls it or whether the supplier asked for the change.
A second person approves the evidence
We recommend that a second authorised person inspects the verification log before approving both the master-data change and any payment that depends on it, under the business's approval policy. At release, recheck the actual payment destination against the approved record, so a change made after approval does not slip through.
This is our control design, not an NCSC requirement. A phone call is one control and can fail if the contact record itself has been tampered with. Multi-factor authentication, bank account validation and two approvers all help, but none makes fraud impossible or guarantees recovery.
The £12,000 run, resolved
In the example, the supplier's established contact, called on the number from the supplier file, says no change was requested. The change stays unapproved and is escalated, and the two affected payments are held while it is investigated. Payments to other suppliers in the run need not stop. The failed verification stays on the log where the next approver can see it.
If money has already gone
Contact the bank immediately and follow the business's incident and reporting process for its jurisdiction. In the US, the FBI also advises reporting to its Internet Crime Complaint Center (IC3); that route is US-specific. Keep the original email, its attachment and the verification log rather than deleting them, because the bank or investigators may ask for them.