Guides

How to verify a vendor’s bank account change before you pay

---

Published October 27, 2026 · About a 6-minute read

A request to change a vendor’s bank details is the riskiest message your office receives, because one wrong update sends every future payment to a stranger. The fix is not software. It’s a short written procedure: call back on a number you already had, have a second person approve the change, and confirm the first payment arrived. This guide gives you that procedure, ready to copy.

Why this matters more in 2026

Nacha, the organization that writes the rules for ACH payments in the U.S., now expects every business that sends ACH payments to have risk-based checks against fraud. That includes payments made “under false pretenses”, such as someone posing as a vendor or an employee to get the account changed. The requirement reached all business senders on June 22, 2026, whatever their size, and the example Nacha gives for a business is “change controls regarding payment information and instructions for vendor and payroll payments” (Nacha’s rule page). Your bank may ask what yours are. The procedure below is a sensible answer; your bank can tell you what it expects in detail.

The rule: verify on a channel the requester didn’t choose

Every scam of this kind depends on you replying through the channel the scammer controls: the email thread, the phone number in the signature, the letter with “our new details”. So the whole procedure comes down to one habit: never confirm a change through the same channel it arrived on. Our guide to the change of bank details email explains the three ways the fake request gets sent; this one is about what to do when it lands.

The procedure, step by step

1. Log the request and change nothing yet. Note who asked, when, and how: email, letter, portal message or phone call. Treat all of them the same way.
2. Call the vendor on a number you already had. Use the number in your vendor file, an old contract or an invoice from before the request. Not the number in the email, the letter or the signature, and not a number someone gives you on a call they made to you. Ask for a person you’ve dealt with before.
3. Let them tell you the details. Ask them to read you the new routing number and the last four digits of the account. Don’t read the numbers out and ask “is that right?”. Ask about something only the real vendor would know, such as the amount of the last invoice you paid.
4. A second person approves it. The person who took the call shouldn’t be the only one who enters the change. In a two-person office, the owner signs off.
5. Don’t rush it. If the request comes with “before Friday” or “the draw goes out today”, pay the next invoice to the old account or hold it until the call is done. A real vendor will wait a day; a scammer is counting on you not to.
6. Confirm the first payment arrived. After the first payment to the new account, call the same known number and ask them to confirm they received it. This catches a mistake before the second payment follows it.
7. Keep the record. Who asked, who you called and on which number, who approved, and the date. It takes a minute, and it’s what your bank or insurer will ask for.

Use exactly the same steps when an employee asks to change where their pay goes. Payroll impersonation is the same trick aimed at a different account.

Things that feel like verification but aren’t

Some banks can check whether the name on a receiving account matches the payee before you pay. It’s worth asking yours what it offers; it adds to the phone call rather than replacing it.

Copy this policy

Write it down once and give it to whoever pays bills, so they have permission to slow down when an email is pushing them to hurry:

Then put the other half on your own invoices: “We will never change our bank details by email. If you get a message saying we have, call us on the number you already have.” It tells your customers exactly what to do when someone pretends to be you.

Your side of it: stop scammers using your name

The procedure protects the money you send. The other risk is someone emailing your customers as you, with your logo and your invoice amounts, asking them to pay a new account. Three things make that harder:

• Your email records. Three settings on your domain, SPF, DKIM and DMARC, let Gmail and Outlook reject email that pretends to come from your exact address. Our guide to business emails going to spam explains them and has a two-minute test.
• Look-alike domains. A scammer can register a name that’s nearly yours, like a .co where your .com should be. Your records can’t stop that, but knowing it exists means you can warn customers and report it.
• Two-step sign-in on every mailbox, because a hacked real mailbox gets past everything else.

Our free audit checks the first two for you: whether someone can send as your exact domain, and which look-alikes of your domain are already registered. On our Care + Evidence plan, your domain’s DNS and email authentication are checked every day, so a broken record is caught before a scammer finds it, and we check every week for new look-alike domains registered against your name.

If a payment has already gone to the wrong account

Call your bank immediately and ask them to try to recall it; hours matter. Report it to the FBI at ic3.gov, and call the real vendor on their known number. Our change of bank details guide has the full list.

Questions people ask us