Two Rings Before the Money Moves: A Supplier Bank Change Check

Most supplier bank detail changes are genuine. A finance team moves banks, a group consolidates accounts, a new finance director tidies up the payment file. The trouble is that the genuine change and the fraudulent one arrive in the same wrapper: a polite email, a PDF on letterhead, and a request to update the master data before the next run.

That is why the useful control is not a clever algorithm. It is a habit. For UK businesses paying suppliers by Faster Payments, the habit should be two phone calls before any sort code or account number changes in the payment file.

The rule in one line

No bank detail change gets actioned from an email alone. Two calls, on numbers you already hold, before the first payment goes to the new account.

It sounds almost too simple. That is the point. Invoice redirection fraud works because it arrives during a busy week and asks for a small administrative favour. A simple rule gives the person in finance permission to stop, even when the email looks perfectly ordinary.

Call one: the person you already know

Use the number in your supplier record, the contract, or the onboarding file. Not the number in the email signature. Not the mobile number in the PDF. The number you had before this request arrived.

Ask an open question first. Something like: we have had a request to change your bank details. Can you confirm from your side whether that is genuine? Then read back the sort code and account number you have been given and ask the supplier to confirm whether they match their records.

There is a subtle but important difference between asking 'is this right?' and asking 'can you confirm this from your side?'. The first invites a yes. The second invites a check.

If the person says they will look into it and come back, that is a hold. Not a maybe. A hold.

Call two: a different known contact

The second call is there to catch the case where one mailbox has been compromised, or where the person you normally deal with is on leave and an out-of-office reply has opened a door. Phone a different known contact at the supplier: a finance manager, an account director, the main switchboard. Again, use a number you already hold.

You are not repeating the first call word for word. You are checking that two separate routes through the supplier organisation land on the same answer. If both calls independently confirm the change, update the record and move on. If they do not, keep the old details live and pause the change.

For smaller suppliers there may not be an obvious second person. In that case, use the next best independent route: the person who signed the contract, the supplier's accountant if you already know them, or a scheduled video call with the known contact. If there is genuinely no second route, slow the change down rather than speeding it up. A signed confirmation sent by post to your office adds friction, and friction is what you want.

Red flags that should pause payment

Some requests deserve a second look even before the first call. These are the patterns that should make you reach for the phone rather than the payment file:

• Urgency. The request arrives just before a payment run, month-end, or payroll, and asks for the change to be made today.
• A new email domain, a changed reply-to address, or a display name that is almost right but not quite.
• A request from someone you have never dealt with, introduced as a new starter or a cover arrangement.
• A request to change all future payments and remove the old account details immediately.
• An account name that does not match the supplier's legal name on the invoice or contract.
• An overseas bank account or a currency change that does not fit the supplier's normal pattern.
• Reluctance to take a call, or an email that says calls are not possible at the moment.
• A change that arrives alongside a sudden request for a copy of your supplier master file or a list of payees.

None of these is proof of fraud on its own. Together they are a reason to slow down. The cost of a paused payment is a phone call and a short delay. The cost of a redirected payment is a recovery process that often starts with your bank, the supplier's bank, and a call to Action Fraud.

A short script that works

You do not need a formal script, but a few set phrases help when the person on the other end is busy.

Hi [name], it is [your name] from [your company]. We have had an email asking us to change your bank details. Before we touch anything, can you confirm from your side whether that request is genuine? I will read back what we have been given: sort code [xx-xx-xx], account [xxxx]. Does that match your records? And can you confirm who authorised it?

Then wait. Do not fill the silence. If the answer is vague, the answer is no for today.

When the call is done, write a short note in the supplier file: date, time, who you spoke to, which number you used, and what was confirmed. That note is not bureaucracy. It is the difference between a verified change and a hopeful one.

Keep the old account live until the checks are done

A useful operational habit is to keep the old bank details active in the payment file until both calls are complete. Do not delete them because a new set has arrived. Do not let a well-written email override a boring process.

If the request turns out to be fraudulent, tell your bank quickly, warn the supplier, and report it to Action Fraud. If it turns out to be genuine, thank the supplier for bearing with you. Most will understand. The ones who have been through a redirection attempt will probably thank you for asking.

Two rings before the money moves is not a sign of distrust. It is a sign that the payment file is being looked after by someone who knows that a sort code is not just six digits. It is the difference between paying a supplier and paying a stranger.