The Bank-Detail Change Verification Test

A request to change supplier bank details may be genuine. The email containing it proves almost nothing.

CLAIM

A bank-detail change should be treated as a change to a control, not an ordinary administrative instruction.

EVIDENCE

Compromised email accounts and convincing impersonation can place a fraudulent instruction inside a genuine conversation. Familiar wording, a correct signature block and knowledge of an invoice do not establish that the payment destination is legitimate.

TEST

The decisive test is independent confirmation through a channel already trusted before the change request arrived.

VERDICT

No independent confirmation, no change. Urgency is a reason to slow the process down, not bypass it.

ACTION — THE BANK-DETAIL CHANGE TEST

1. Freeze the change. Do not amend the supplier record or release payment.
2. Use a pre-existing contact. Call a known contact using a number from the existing contract, verified supplier master record or official website—not the message requesting the change.
3. Ask open questions. Confirm the change, effective date, reason and account name without reading every detail from the request.
4. Require dual approval. One person verifies; another approves the amendment.
5. Record the verification. Date, time, person contacted, number used, questions asked and outcome.
6. Notify the known contact. Send confirmation to the previously established address as well as any new address.
7. Control the first payment. For material changes, consider an independently approved test payment or enhanced review under the organisation’s policy.

RED FLAGS

• Pressure to act before a deadline
• A request to avoid the usual contact
• A new domain, subtle spelling variation or reply-to address
• An explanation involving an audit, frozen account or confidential transaction
• A simultaneous change to contact and bank details
• Resistance to established verification controls

IF PAYMENT HAS ALREADY BEEN MADE

Contact the bank immediately through a trusted channel. Preserve the request, full email headers, invoice, payment approval, supplier record and every verification attempt. Contact the genuine supplier using established details.

CONTROL TEMPLATE

Change requested: ______
Existing trusted contact: ______
Independent number/source: ______
Confirmed by: ______
Verified by: ______
Approved by: ______
Date/time: ______
First-payment control: ______

Evidence & official sources

• NCSC: defending an organisation against phishing
• NCSC: spotting scam messages and calls

The Verification Desk distinguishes verified fact, evidence-led inference and unresolved uncertainty. This publication provides general information, not legal, financial, regulatory or emergency advice. Findings reflect the evidence available at publication and may be updated if material evidence changes.