Verify supplier bank changes through independent contact checks, clear approval records and a documented payment-control workflow.
A request to change a supplier’s bank details can look routine. It may arrive in a familiar email conversation, include a convincing letter and refer to an invoice your team recognises. Those details make the request easy to process quickly, but they do not establish that the destination account is authorised by the supplier.
The business needs a workflow that treats a bank change as a separate controlled event. Receiving the request, confirming it, updating the supplier record and releasing payment should each leave a clear trail. The aim is to give staff a dependable process they can follow even when a message sounds urgent or appears to come from a senior colleague.
Put the payment instruction on hold, not the entire relationship
When a request arrives, create a change record and prevent the new details from becoming usable until verification is complete. This does not mean accusing the supplier of wrongdoing. Explain that the organisation applies the same confirmation process to all bank-detail changes, including legitimate ones.
Record the supplier identifier, request date, channel, affected account and any payment already scheduled. Preserve the original message in the approved evidence location. Limit access to the banking information and avoid circulating it through broad email groups merely to obtain awareness.
Distinguish the change request from the underlying invoice approval. The invoice may be valid while the proposed payment destination is not. Conversely, authentic bank details do not prove that a particular invoice is due. Keeping these checks separate prevents one legitimate document from being used to validate an unrelated instruction.
Establish a trusted contact route before it is needed
Maintain supplier contact information through the approved onboarding process. Identify an appropriate contact for payment administration and a backup where practical. Store the source and verification date so staff can assess whether the information remains suitable for a later callback.
The FBI’s business email compromise guidance advises independently checking contact details and verifying changes to account numbers or payment procedures. It also highlights pressure to act quickly as a warning sign. These are general fraud-prevention principles, not a statement of Pakistani reporting requirements.
For the business workflow, define which independently established sources are acceptable. A phone number supplied only in the change request should not validate that same request. If the existing contact is unavailable or the record is outdated, use a documented escalation route to re-establish the supplier’s identity before proceeding.
Make confirmation a conversation about the actual change
The verifier should confirm that an authorised supplier representative requested the change and understands which account is affected. Use the organisation’s approved method for comparing the proposed details without unnecessarily exposing full banking information. A vague confirmation that “the email is genuine” may leave important ambiguity.
Record who was contacted, how the contact route was obtained, when the conversation occurred and what was confirmed. The record should be sufficient for a reviewer to understand the basis of the decision. It should not include unnecessary personal information or a transcript of every remark.
If the supplier says no change was requested, stop the update and invoke the incident process. If the response is uncertain, keep the request pending. Staff should not convert uncertainty into approval because a payment deadline is approaching. The escalation path must make it possible to resolve urgency without bypassing verification.
Separate the roles around master-data changes
Where staffing allows, use different people to request or enter the change, verify it and approve its use. The precise division can vary with the organisation, but one person should not be able to silently replace supplier details and release payment without another meaningful check.
In a small company, compensating review may be necessary because the finance team is limited. Define that review explicitly. For example, an authorised manager can examine the verification evidence and compare the approved change with the supplier record before the first affected payment. The review must involve actual evidence, not a routine approval click.
Restrict permission to edit supplier master data. Staff who prepare invoices may not need authority to change payment destinations. Review access when roles change and periodically thereafter. Shared accounts weaken accountability because the audit record cannot reliably show which person performed the change.
Control the update and the first payment separately
After approval, the authorised administrator should update the correct supplier record and retain the change reference. Check for duplicate supplier records that could leave the old and new instructions active in different places. Confirm which open invoices and scheduled payments are affected by the effective date.
Require a comparison between the approved request and the saved record. This catches ordinary transcription errors as well as unauthorised substitutions. Where the application provides an audit history, preserve or reference it through the approved process. If the software lacks adequate change tracking, maintain a controlled supplementary record.
Before releasing the first payment using changed details, the payment approver should see that verification was completed and that the destination matches the approved record. This is a separate control point. It should not require repeating every earlier task, but it should prevent an incomplete change from slipping into a payment batch.
Design an exception route that does not erase the control
Urgent payments, unavailable contacts and executive requests are predictable situations. Write the exception process before they occur. Specify who can decide on a delay, seek another verified contact or approve an alternative operational arrangement. The process should preserve independent confirmation of the destination.
An instruction from a senior executive does not establish that the supplier owns the proposed account. Staff should have a respectful script for explaining the required check and an escalation route if they are pressured to skip it. Leadership should support that script publicly so the employee is not left negotiating the policy alone.
Keep exception records visible to the control owner. Repeated urgent requests from the same workflow may indicate poor planning, inadequate contact records or a supplier communication problem. Fixing those causes can reduce friction without weakening the verification step.
Include other channels in the same process
A bank-change request may arrive by messaging app, a portal, a paper letter or a telephone call. The channel changes the evidence available, but it should not remove the need for authorisation and independent verification. Staff should know where to record requests received outside the usual finance inbox.
Treat changes to the trusted contact itself as significant. If a message asks the business to update both the supplier’s telephone number and bank details, the new number cannot provide independent confirmation of the banking change. Use the established escalation process to verify the contact change through another trusted route.
Apply equivalent care to changes in payment procedure, beneficiary name or intermediary instructions where these affect the destination or handling of funds. Avoid narrowing the policy so much that staff recognise only an account-number change as requiring review.
Prepare for a suspected fraudulent payment
If a payment may have gone to an unauthorised destination, notify the designated internal incident lead and contact the financial institution promptly through an established channel. The FBI’s guidance also recommends immediate contact with the financial institution after suspected business email compromise. The bank can explain available actions; recovery should never be assumed or promised.
Preserve messages, change records, payment references and relevant audit evidence through the incident process. Have authorised technical staff assess whether an email account or other system may be compromised. Avoid asking ordinary finance users to investigate suspicious links or make unplanned system changes.
Determine external reporting and notification obligations with the appropriate legal, compliance and management advisers for the organisation’s circumstances. Keep a timeline of decisions and communications. A coordinated response is easier when contact information and responsibilities were prepared before the event.
Test the workflow with a harmless scenario
Use a fictional supplier and clearly labelled exercise material. Walk through a routine change, an urgent request, an unavailable trusted contact and a change discovered after a payment batch was prepared. Do not introduce real bank details or send realistic deceptive messages without an approved exercise plan.
Observe whether staff can find the trusted contact record, identify the approver and explain what blocks release. Check whether the system allows an incomplete request to reach payment preparation. The exercise should improve the process, not embarrass employees who reveal a gap.
Review completed change records periodically. Look for missing evidence, repeated exceptions and approvals made after the update. Maxicon’s services overview is a relevant starting point for discussing the technology and access controls supporting this workflow. To explore your requirements, contact Maxicon with a redacted process map and the systems involved.
Frequently asked questions
Is a signed supplier letter enough to approve a change?
Treat it as supporting material, not independent confirmation by itself. The workflow should establish that an authorised supplier representative requested the change through a trusted route. A convincing document can still be attached to an unauthorised request, and ordinary administrative mistakes can also occur.
Can we reply to the email to verify the new details?
A reply remains within the same communication channel that delivered the request. It therefore does not provide the independence the workflow is designed to achieve. Use an established contact route and record the confirmation, especially when the request changes where the business will send money.
What if the supplier needs payment immediately?
Escalate the deadline to the authorised decision maker while keeping verification in place. Management can discuss timing or another approved arrangement with the supplier. Urgency should change the speed of coordination, not allow unverified destination details to become valid automatically.
Does a small finance team need separate approvers?
Use as much separation as practical and document a meaningful compensating review where staffing is limited. The key is that a person independent of the change examines the evidence before affected payment release. A nominal second approval without checking anything adds little protection.
Should we record the verification call?
Not necessarily. A controlled record of the contact route, participant, date and confirmed change may be sufficient for the business process. If call recording is considered, review applicable requirements and organisational policy first. Collect only the evidence needed and protect it appropriately.
Related technology support
For an additional service perspective related to this guide, explore Trubyte’s managed IT services in Karachi.
Discuss your requirements with Maxicon
Tell us about your business, current environment and the support you need.
