Supplier Bank Detail Change Fraud: Securing the Year-End Payment Run

If a supplier sends you new bank details in November or December, do not pay them until someone on your team has phoned that supplier on the number you already held on file, not a number in the email, and confirmed the change with a person they can name. That one callback, completed before the payment is released, stops almost every version of supplier bank detail change fraud. Everything else below is about making sure the callback actually happens in the one month when your approver is on leave, your volume has doubled, and the person running the payment is covering for somebody else.

What does supplier bank detail change fraud actually look like?

It is almost never a hack of your accounting system. It is an email, and it is a good one.

The attacker either breaks into your supplier's mailbox or registers a domain that differs from theirs by one character, then waits and reads. When a real invoice is due, you receive the real invoice. The purchase order number is correct. The amount is correct. The signature block, the logo and the payment terms are correct, because they were copied from genuine correspondence. One line has changed: the bank account.

The common dressings are worth recognising on sight:

• Our corporate account is under audit this quarter, please remit to our alternate account.
• We have changed banks, new details on company letterhead, signed by a director.
• Kindly settle before 31 December as our books close, we have updated our remittance details.
• A reply inside a genuine thread you started, with the change sitting three messages down.

Amounts are chosen to look boring. A fraudster who takes one invoice of eight thousand dollars is far more likely to succeed than one who asks for ninety thousand.

Why is the December payment run the easiest month to steal from?

Four things stack up at once, and each of them weakens a control you rely on all year.

Volume hides the odd one out. A payment run that normally carries twenty items carries fifty, because everybody wants to be settled before the year closes.

Urgency stops being a warning sign. In March, a supplier pressing for same-day payment is unusual. In December, every supplier is pressing, so the pressure in a fraudulent email reads as perfectly normal.

Your second pair of eyes is on leave. The person who would have said that account number looks new is off until 2 January, and the cover arrangement is a handover note rather than a trained approver.

Detection is delayed by weeks. On thirty or sixty day terms, the genuine supplier does not chase until late January. By then the money has been moved through two or three mule accounts and withdrawn. With instant local transfers, the first hop takes seconds.

What is the control that stops it?

Treat a bank account change as a change to your supplier master record, never as part of approving an invoice. They are two different decisions and they must not travel in the same email thread. Write these six steps down and keep them to one page:

1. Callback on a number you already hold. Use the contact number in your own records or on an old signed contract. Never a number in the request. If the only number you have is dead, the request is not verified yet.
2. Speak to a named human. Record who confirmed it and when. A voicemail, a WhatsApp reply or an email confirmation is not verification, because the attacker may control those channels.
3. Separate the two hands. Whoever updates the bank account must not be the person who releases the payment. In a small team this may mean the owner holds the release.
4. Hold a cooling period. Twenty four hours between a verified change and the first payment to the new account. Fraud depends on speed, and this is the cheapest brake you own.
5. Test with a small first payment. Send a token amount, confirm receipt by phone, then release the balance.
6. Freeze changes during the run. No bank detail changes are accepted in the fourteen days before your year-end payment run. Anything that arrives waits until January. Suppliers accept this readily, and fraudsters cannot.

Who should be allowed to change a bank account in your system?

Name the people, not the roles, and keep the list to two. Then check three things you probably have not looked at this year.

Standing admin access. Most small companies have more administrators in their accounting software than they have finance staff, usually because a bookkeeper, an ex-employee and an external accountant were all granted full rights at some point. Open the user list and read it.

Audit logging. Confirm that supplier record changes are logged with a user and a timestamp, and that the log is retained. If a change cannot be attributed, you cannot investigate.

Departed staff. Anyone who has left and still holds access to your finance system or a shared mailbox is an open door. Close it before the January intake arrives and the access list gets longer again.

What do you do in the first hour after a wrong payment goes out?

Recovery falls sharply once funds are withdrawn, so the order matters more than the completeness.

1. Call your bank's fraud line first, before telling anybody else, and ask them to attempt a recall and to flag the receiving account. Do this even if the transfer was yesterday.
2. File a police report so the matter reaches the anti-scam process that can freeze a receiving account.
3. Tell the genuine supplier by phone. Their mailbox may be compromised, and your email could be read by the attacker.
4. Preserve the evidence. Keep the original emails with full headers. Do not delete, forward or clean up the thread.
5. Check your own house. Look for mail forwarding rules or new inbox rules nobody created, and check whether other suppliers received similar requests. One compromised mailbox is often used against several payers.
6. Notify your insurer within the policy window. Many cyber policies treat this as social engineering fraud and expect evidence that your verification procedure existed and was followed.

How do you prove the control worked at year end?

Keep a single sheet listing every supplier bank detail change made during the year, with the date, who requested it, who verified it, the number they called and the name of the person who confirmed. It takes a few minutes a quarter and it does three jobs: it satisfies an auditor asking about payment controls, it supports an insurance claim if the worst happens, and it quietly tells your team that this step is checked rather than assumed.

If that sheet is empty for the year, the honest conclusion is not that you had no changes. It is that nobody recorded them.

Frequently asked questions

The request came from the supplier's real email address, so is it safe?

No. A genuine sending address means the mailbox is genuine, not that the sender is. Mailbox compromise is the most common form of this fraud precisely because the email passes every technical check your provider runs. Only a callback on an independently held number resolves it.

We are a team of eight and one person does all the payments. How do we separate duties?

Split the two decisions rather than the two jobs. Your finance person can prepare everything, but the owner approves any new or changed bank account by phone before release. That is one short call per change, perhaps three or four times a year, and it is the only control in this article that cannot be delegated away.

Will our bank reverse the payment if we report it quickly?

They will attempt a recall and may succeed if the funds are still sitting in the receiving account, but there is no guarantee and no automatic right to reversal. Because you authorised the transfer, the loss sits with your company unless the money is recovered. Prevention is the only reliable control, which is why the fourteen day change freeze before your year-end run is worth the mild inconvenience.