Bank detail change: verification checklist
By Jose PollmanPublished
One page, to print or save as PDF and keep with the payment. It records the one control that actually stops this fraud — a voice call on a number you already had — and who did it, which is what makes it auditable rather than remembered.
Print this page, or use your browser’s print dialogue and choose “Save as PDF”. Everything except the checklist is left out of the printed page.
Before you change anything
- Record who asked, when, and through which channel. Attach the original message.
- Confirm this changes an account you have paid before. A first invoice from a new supplier is a different situation — verify the supplier, not the change.
- Do not update the supplier record yet. The record is what a later payment reads; changing it first means an unverified account is already live.
The call — this is the control
- Write down the phone number you used and where it came from: an earlier invoice, your accounting system, or the supplier’s website that you navigated to yourself.
- Confirm it is NOT the number in the request, in the email signature, or on the new invoice. An attacker who controls the mailbox controls those too.
- Reach a person you can name. A voicemail, a callback you did not initiate, or a reply by email is not confirmation.
- Read the last four digits of the new account to them. Do not let them read the digits to you — that only confirms what the request already said.
- Record who you spoke to and the date and time of the call.
Before the first payment leaves
- Note what your bank’s payee-name check reported: match, close match, or no match. A close match is not a match — query it.
- Consider a small first payment, confirmed received by phone before the balance follows.
- Update the supplier record in the accounting system, not in the inbox, so the next payment reads a verified account.
Sign-off
- Requested by (name, date):
- Verified by voice (name, number used, date):
- Approved for payment by (name, date) — a different person from the one who received the request:
Keep this with the invoice. If the change turns out to be fraudulent, this page is the record of what was checked and by whom — and a call your bank can act on within hours rather than days.