The Known-Number Check: Verifying Supplier Bank Changes Before Money Moves
Supplier bank-detail changes are ordinary events. A supplier restructures its banking, switches accounts or changes its finance team, and the request lands in the purchase ledger inbox. The difficulty is that the same request is also one of the most effective routes into a UK SME's cash. In 2026, payment fraud rarely needs a technical breach. It needs a convincing message, a moment of urgency and a finance team that treats a bank-detail update as an administrative task rather than a financial instruction.
Why a bank-detail change is a payment instruction
A sort code and account number are not merely reference data. They decide where money goes. When a supplier asks to change them, the business is being asked to redirect future payments to a new destination. That is a treasury decision, even if it arrives as a short email from a known contact.
The common pattern is familiar. An email appears to come from a genuine supplier, often from a slightly altered domain or a compromised mailbox. It explains that the company has changed banks, apologises for the short notice and asks for the next payment to be sent to new details. The tone is helpful. The invoice attached may be real. The only false element is the account.
For a UK SME, the loss can be immediate. Faster Payments settle quickly, and recovery depends on speed, bank cooperation and whether the receiving account still holds funds. Prevention is therefore less about detective work after the event and more about a fixed procedure before any vendor record is amended.
The call-back rule: use a number you already hold
The central control is simple: never verify a bank-detail change using contact details supplied in the change request itself.
A call-back must be made to a number the business already holds independently. That may be the number in the signed contract, the vendor onboarding record, a previously verified purchase ledger entry or the main switchboard number on the supplier's own published contact page. It should not be the number in the email signature, the letterhead attached to the request or the mobile number quoted in the message.
When the call is made, the person should ask for the finance contact by name and confirm the request in plain terms. They should not read out the new account details and ask for a yes or no. Instead, ask the supplier to confirm the change from their side, including the legal account name, the reason for the change and the effective date. A supplier that has genuinely changed banks will be able to explain the change. A fraudster on the end of a diverted line will often struggle or apply pressure.
If no independently verified number exists, do not process the change. Escalate it. A new supplier with no established contact record should be onboarded through a separate verification step before any payment is made. Urgency is not a substitute for verification.
Separate the approver from the payer
A call-back is stronger when it is supported by segregation of duties. The person who approves a supplier bank-detail change should not be the same person who releases the payment.
In a small finance team, this can feel impractical. It is still worth designing a compensating control. The finance manager might approve the change, while the director or owner releases the payment. Where one person handles both roles day to day, a second reviewer such as an external accountant or a director outside the payment run can provide the check. The principle is that one person should not be able to alter a supplier's bank details and send money to the new account without another person seeing the change.
The control should also cover the vendor master. Access to supplier records should be limited, and changes should be logged. If the accounting system supports approval workflows, use them for bank-detail amendments, not just for invoices. If it does not, a manual change log with a second signature is better than an unrecorded edit.
What to verify before the record changes
Before amending the supplier record, confirm the legal name on the account, the sort code and account number, and the date from which the new details apply. Run a Confirmation of Payee check where the bank provides it. A mismatch is not proof of fraud, but it is a reason to pause and investigate. A match is not proof of legitimacy either; it only confirms that the name and account details align at that moment.
Ask whether the supplier has notified other parts of the business. A genuine change often affects statements, remittance advice and purchase orders. A fraudster may not know those details. Check the supplier's existing records for consistency and consider whether the request has arrived at an unusual time, such as just before a large payment run or during a holiday period.
A short record-keeping template
A simple record turns the control from a good intention into an auditable process. The template need not be elaborate.
| Field | What to record |
|---|---|
| Date and time of request | When the change request arrived |
| Requester and channel | Name, email address and whether the request came by email or portal |
| Old bank details | The details currently held in the vendor master |
| New bank details | The proposed sort code and account number |
| Call-back number source | Where the independently verified number came from |
| Person spoken to | Name and role of the supplier contact |
| Verification outcome | What was confirmed and any points of concern |
| Change approved by | The person authorising the vendor record amendment |
| Payment released by | The person releasing the next payment |
| Confirmation of Payee result | Match, partial match or no match |
| Notes | Any follow-up, including confirmation from the supplier |
Keep the record with the supplier file and retain it in line with the business's normal accounting retention policy. The point is not bureaucracy. It is to show who checked what, when and against which source.
If a payment may already have gone astray
Speed matters. If there is reason to believe a payment has been sent to fraudulent bank details, contact the bank immediately using its dedicated fraud line rather than waiting for general customer service. Ask for the payment to be recalled and follow the bank's instructions. Do not send further payments to the same account.
Preserve the evidence. Keep the original emails, including headers where possible, the call log, the vendor record and any payment confirmation. Do not delete or forward messages in a way that alters them. Inform senior management and the insurer promptly. Report the matter to Action Fraud in England, Wales and Northern Ireland, or to Police Scotland in Scotland. If personal data has been compromised, consider whether an Information Commissioner's Office notification is required.
Contact the genuine supplier using the independently verified number, not the contact details in the suspect request. Ask whether their email account has been compromised and whether other customers may be affected. Then review the vendor master for other changes made around the same time. Fraudsters often test one small change before attempting a larger one.
Making the control stick
The call-back rule works when it is routine. Put it in the finance manual, include it in induction training and make it clear that no one will be criticised for delaying a payment to verify a bank change. A short delay is a cost. A redirected payment is a loss.
For UK SMEs, the most practical defence is a predictable process: verify through a known number, separate approval from payment, record the check and act quickly if something goes wrong. The request may look like an admin update, but the money treats it as an instruction.
