A vendor bank-detail change should be treated as a separate, verified request even when the supplier and invoice are familiar. Preserve the request, hold affected changes or payments as appropriate, verify through a previously established contact route and require authorized approval before updating the payment record.
Separate supplier identity from invoice approval
Maintain the legal supplier identity, approved contacts and payment instructions as distinct information. Confirming that goods arrived or an invoice is valid does not confirm a new destination for funds. A project manager may know the work was delivered without having authority to approve bank changes. Define who maintains vendor records, who verifies a request and who releases payment. These responsibilities should remain clear even when a small office assigns more than one administrative role to the same person.
Preserve the request and pause the affected action
Retain the original message, attachments, sender information and receipt time. Create a change request linked to the vendor rather than editing the master record immediately. Identify pending payments that could be affected and use the business’s hold procedure. Urgency, an ongoing email thread or a familiar display name should not replace verification. The FBI’s business email compromise guidance describes payment redirection risks and recommends verifying payment changes through independent contact.
Verify using an established contact route
Contact the supplier through information already trusted before the request, such as the existing approved vendor record. Do not rely solely on a telephone number supplied in the change message. Record who performed the verification, the contact used, what was confirmed and any unresolved inconsistency. Avoid storing unnecessary sensitive banking data in open notes. If identity or authority remains uncertain, leave the change unapproved and escalate to the responsible financial decision maker instead of trying to infer legitimacy from writing style.
Approve, update and read back the record
Use the business’s required approval process, with separate review where appropriate. Preserve old and new instruction references securely, the approver and effective date. Update the authoritative system once, then inspect the resulting record to confirm the intended change. Check downstream payment tools rather than assuming all systems synchronize immediately. AI can assemble an evidence packet or flag mismatched supplier names, but it should not independently approve destination changes or release money because the administrative checklist appears complete.
Monitor exceptions and rehearse a suspicious request
Review the first affected payment through the normal authorized process and investigate unexpected destination or status differences. If compromise is suspected, follow the business’s incident procedure and promptly contact the relevant financial institution through trusted channels. Track changes lacking independent verification, unauthorized edits and discrepancies between vendor systems. Test a convincing request that includes a new callback number. The workflow should preserve the message, maintain the hold and direct staff to the established contact rather than reward the apparent completeness of the request.
Keep building your understanding
Start with one useful workflow.
Tell us what happens today and where it gets stuck. We’ll help define a practical next step.