Invoice fraud: how to verify a supplier’s bank-account change

When a supplier asks you to change its bank details, pause the change and compare it with the approved supplier record. Verify the request through a contact already known to your organisation, then use the normal vendor-record and payment approvals. A familiar email address, invoice number or thread does not authorise a new account.
This guide is for accounts payable, procurement and colleagues who forward supplier requests. It provides a complete change workflow and invoice-comparison worksheet. The point is to establish where a payment should go, not to guess whether a document looks fraudulent. Real account changes can proceed once the checks and approvals are complete.

Compare two invoice records without treating either as proof

Use this fictional worksheet in a team discussion. Both documents describe the same delivery, amount and invoice number. Only the payment destination and contact instruction change. Account A and Account B are labels, not usable banking details; the example address accounts@northstar-supplies.example is reserved for illustration.
The established record is your comparison point, but it must itself be maintained and access-controlled. An old email forwarded by the requester is not automatically an approved record. After identifying the mismatch, write “change requires verification” rather than “confirmed fraud”. The supplier could have a legitimate reason to change banks.

Field | Approved record | New request | Decision
Supplier | Northstar Supplies | Northstar Supplies | Matching name provides context.
Invoice / amount | NS-1048 / €12,400 | NS-1048 / €12,400 | Expected work; no approval of the change.
Payment destination | Account A in vendor record | Replace with Account B | Hold and verify the change.
Contact route | Existing purchasing contact | New number in email signature | Use the established contact.
Effective date | No change recorded | Use today for all invoices | Clarify scope before any update.
Approval | No change approval recorded | “Already agreed with your manager” | Verify through the normal approval system.

Keep a complete supplier-change record

The person who spots the request may not have permission to alter the vendor master or release money. Assign those responsibilities explicitly. An independent approver should review the verification evidence and the entered payment details, not just click through a notification saying someone else has checked.
Use this record in the approved finance system or adapt it as a worksheet. Store account information with appropriate access restrictions. Link evidence rather than copying sensitive banking details into broad chat channels. Include failed verification attempts so that a colleague cannot accidentally restart the same request as if it were new.

Field to complete | What to record
Request and scope | Supplier ID, invoice references, requested change and effective date.
Trusted source | Approved record location and the contact route used.
Verification | Date, person reached, authority and confirmed details.
Exceptions | Unanswered questions, failed callback or conflict with existing information.
Record owner | Authorised person who will update the supplier data.
Independent approval | Approver, evidence reviewed and approval reference.
Payment release | Final destination checked against the approved updated record.
Outcome | Accepted, rejected or held, with owner and next action.

Request and scope: ________________________________________

Trusted source: ________________________________________

Verification: ________________________________________

Exceptions: ________________________________________

Record owner: ________________________________________

Independent approval: ________________________________________

Payment release: ________________________________________

Outcome: ________________________________________

The supplier’s year-end bank change

A known supplier replies in the usual invoice thread: “Our year-end bank migration is complete. Please use the attached details. Your manager has agreed; call my new direct number if needed.” The delivery and amount match your purchase order.

Approve because the amount and existing email thread match.
Hold the change, call the established supplier contact and route the evidence through normal approval.
Send a small test payment to the new account and approve if it arrives.

________________________________________

Hold the change and use the established supplier contact, followed by the normal approval process. A test payment only shows that an account can receive money; it does not authenticate the supplier’s authority.
Identify the trusted contact source, authorised record owner and independent approver. If any of these is missing, describe the escalation instead of inventing a confirmation.

Business Email Compromise: prevention and response
https://www.fbi.gov/how-we-can-help-you/common-frauds-and-scams/business-email-compromise

Tips to prevent digital invoice fraud
https://www.politie.nl/informatie/tips-om-digitale-factuurfraude-te-voorkomen.html

What to do about transfer fraud or false bank details
https://www.cybermalveillance.gouv.fr/tous-nos-contenus/fiches-reflexes/que-faire-en-cas-de-fraude-au-virement-ou-au-faux-rib

2025 Internet Crime Report, pages 7–8 and 62
https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf