When supplier bank details change: a verification handover

The useful purchasing task is to connect the change request to a responsible finance reviewer without treating the request itself as confirmation. Keep the original order references intact and open a separate verification record.

The FBI's business email compromise guidance describes both lookalike addresses and criminals gaining access to genuine billing conversations. It advises checking changes to account numbers or payment procedures and treating pressure to act quickly with particular care.

That means a recognisable email chain, a correct part description or knowledge of a shipment is insufficient, on its own, to verify the requested change. This is a reason to check a change, not a finding that a particular supplier or message is fraudulent.

The Europol invoice fraud sheet describes impersonated suppliers requesting different bank details. Its advice includes verifying such requests using contact details from earlier correspondence rather than those supplied in the change request. The IC3 prevention guidance likewise recommends a secondary channel to verify changes in account information.

Use three explicit questions in the internal handover:

This three-decision layout is an editorial handover suggestion. It is not a bank-account validation service, an instruction to pay or a replacement for your organisation's controls.

• What changed? Identify the invoice, order or supplier record affected and the class of instruction being changed. Do not replace the established record with the proposed one while describing the request.
• What was independently checked? Record the trusted contact route used, how that route was established and the actual result. Replying within the same questioned conversation is not a separate check.
• Who may approve the operational change? Identify the responsible reviewer and the organisation's applicable supplier-record and payment approval steps. A completed callback is not a payment authorisation.

Use restricted internal references for banking evidence. The worksheet needs to show the check's state and ownership; it does not need bank account numbers, access codes or copies of identity documents.

A reference in this log should let an authorised colleague locate the underlying evidence in your own controlled files. It should not expose banking data through a shared buying brief or a public enquiry form. Choose access and retention arrangements under your own policies.

SUPPLIER PAYMENT-DETAIL CHANGE — INTERNAL VERIFICATION HANDOVER
Keep bank account values, credentials and identity documents out of this worksheet.
This record does not approve a supplier change or release a payment.

Change case reference:
Affected order / invoice / supplier-record references:
Request received — actual date, channel and retained-original reference:
Requested change class — no banking instructions:
Independently established contact-record reference:
Verification owner role:
Actual check action and date:
Actual result, restricted evidence reference and unresolved points:
Current disposition — verification required / unresolved / checked awaiting own approval:
Separate supplier-record change approval reference — or pending:
Separate payment-release approval reference — or pending:
Next action, owner and agreed review point:

Use your own access, retention, supplier-record and payment approval policies.

Consider this hypothetical case. A buyer is reviewing an order for metal closures when a message in the existing conversation requests a different payment account. The product description and destination have not changed. No real customer, payment or incident is described here.

The buyer keeps the existing order reference and opens a change case with verification required. A callback number supplied in the new message is part of the unverified request, so it is not recorded as an independent contact basis.

The finance reviewer uses a separately established contact record. If the relevant person cannot be reached, the log records unresolved, the attempted check and the responsible next action. It does not turn an unanswered call into approval or invent a response because dispatch is approaching.

If the request is corroborated through the organisation's approved process, the reviewer records that result and routes the separate supplier-record and payment decisions to the authorised approvers. The worksheet itself never releases a payment. The order reference still connects the commercial discussion, but no silent banking change has been folded into it.

Use your incident process promptly. The UK's National Cyber Security Centre guidance directs affected businesses to contact their IT support and bank through the bank's official contact route. Reporting arrangements depend on the organisation's location; follow the applicable official route. Do not assume a verification worksheet can recover funds or that a recovery is guaranteed.

The international buying brief is useful for linking part lines, quantities and receiving points. Keep payment-change verification in your internal finance process, using only a non-sensitive case reference in a wider purchasing handover if your policy allows it. Do not paste bank details into the YAKU enquiry workspace.

For the distinction between the buyer, invoice routing and physical receiver, the three-record enquiry map covers that separate task. Confirming where an invoice should be sent does not, by itself, confirm who should receive its payment.