Reviewed October 17, 2026. This practical guide replaces an earlier general overview; the original publication date and URL are retained.
A request to change a supplier’s bank details deserves a separate verification step from ordinary invoice approval. A legitimate invoice can be paired with fraudulent payment instructions. A documented change process helps the payables team resist urgency while keeping normal supplier payments moving through an accountable review.
Separate the change from the invoice
Create a record for the requested payee change, including the supplier account, request date and proposed effective date. Do not overwrite the existing verified instructions immediately. Flag open invoices that could be affected so the next payment run does not quietly pick up unverified details.
Use an established contact route
Confirm the request through a previously verified supplier contact or another independently established channel. A telephone number included in the change request does not independently validate it. Record who performed the check and the outcome without storing complete bank information in a general email thread or team chat.
Require approval before activation
Define who can enter new details and who can authorize their use. Where staffing is limited, have the owner perform a documented secondary review rather than treating the same employee’s second click as independent approval. Log the effective date, verification method and first payment covered by the change.
Plan a response for a suspected mistake
Keep the bank and payment-provider escalation contacts available before an incident. If a payment may have gone to the wrong recipient, contact the relevant institutions promptly through known channels and preserve the evidence. Do not wait for a monthly reconciliation to investigate a supplier who reports a missing payment.
Source and next steps
The FTC’s small-business cybersecurity resources address common cyber threats. This workflow is an operational control and does not guarantee that a fraudulent instruction will be detected or a payment recovered. Read FTC cybersecurity for small businesses.
Continue with B2B Payments: Connect the Invoice, Remittance and Bank Record and Payment Cybersecurity: Protect Access, Device Changes and Recovery.
For the regional operating checklist and further reading, use the AMS New York merchant guide. Explore related topics in Eric Kuvykin’s reading paths.
