Cooling-off period for vendor bank changes: how long

Why hold a change that already passed the callback

Calling the vendor on a number you already had is the step that does most of the work (see the callback rule). The hold covers what a call cannot:

• A call can go wrong quietly. The person who answered was new or rushed, or assumed a colleague had asked for the change. Nobody notices on the day.
• The number on file can itself be bad. If an earlier email quietly changed the phone number in your vendor record, a textbook callback reaches the wrong people.
• Fraud usually surfaces through the real vendor. They chase an unpaid invoice, find a forwarding rule in their own mailbox, or answer the notice you sent them. Each of those takes days, not minutes. A hold lets the news arrive before the payment does.
• Money is hard to pull back. In 2025 the FBI's Recovery Asset Team worked 3,900 incidents involving about $1.16 billion in attempted theft and froze $679 million of it, a 58% success rate. The report's advice once a fraudulent transfer is found: "time is of the essence" (IC3 2025 report). A hold moves the waiting to before the payment, where it costs almost nothing.

Teams that have had a near miss tend to write all of this as one rule. From an r/Accounting thread about a vendor email compromise that nearly cost a six-figure wire: "any banking change requires a callback using a number from our vendor master, plus dual approval and a short cooling off period before payment" (r/Accounting).

How long: 48 hours is a sensible default

We know of no rule or standard that sets the number. Pick one, write it into your policy and apply it to every change. 48 hours is a common default because:

• It spans two working days. That is long enough for a notice to the vendor's known contact to be read and answered, and for their accounts team to notice anything odd.
• It rarely costs the vendor anything. Many payment runs are weekly and many invoices are on 30-day terms, so a two-day hold on the first payment usually lands inside the normal schedule.
• It is short enough to keep. A hold so long that people ask for exceptions every week protects less than a short one that is never skipped.

Count working time, not clock time. A change approved at 4 pm on a Friday and held for 48 clock hours ends on Sunday afternoon, when nobody has looked at anything. Either write the hold as two business days or check that each release falls on a working day.

Some changes deserve a longer hold, or a second callback to a different contact at the vendor:

• The first payment on the new details is unusually large, or goes to a vendor you have not paid for months.
• The new account is in another country or currency, or the account name does not match the vendor.
• The same request also changes the vendor's phone number, email address or remittance contact.
• A second change arrives during the hold, or the "new" account number changes again.

What happens while the hold runs

1. Send a notice to the vendor's known contact, at the email address or phone number in your vendor master, not as a reply in the request thread: "We received a request to change your bank details to an account ending 1234, effective [date]. If you did not ask for this, call us on [your number] before then." A reply in the thread may go to whoever sent the request.

2. Leave scheduled payments on the verified details unless the vendor told you on the callback that the old account is closed. In that case those payments wait for the hold to end.

3. Treat pressure as a signal. A chaser asking you to pay before the hold ends, a "corrected" account number, or a request to keep the change between you and the sender are reasons to stop and call again on the number on file.

4. Release on the date, not from memory. When the hold ends, the person who releases the change updates the payment system and writes down which system, when, and the reference.

What to do with "urgent"

Urgency is what this kind of fraud runs on. Nacha's response plan for business email compromise says it plainly: "Be especially wary if the requestor is pressing you to act quickly" (Nacha). Real emergencies do happen, such as a vendor whose old bank froze their account, so the policy should allow an exception and make it awkward to abuse:

• The word "urgent" changes nothing. Only a reason the vendor confirmed on your callback can shorten a hold.
• The exception is written down. One or two sentences: what the emergency is, who at the vendor confirmed it and on which number, and what was done in place of the waiting time, such as a second callback to a different known contact.
• Someone else decides. Not the person who received the request and is feeling the pressure. The approver, or someone senior to them, signs the exception, and their name goes on the record.
• Exceptions get counted. If they turn up every month, either the default is wrong for your business or someone is testing it. Review the list each quarter.

A line that helps on the phone: "Our policy holds every bank change for two business days, so the payment goes out on [date]. If that causes a real problem, tell me what it is and I will take it to [role]."

What to record

A hold nobody can show afterwards looks the same as no hold. For each change, keep:

• When the request arrived and when the callback confirmed it.
• Who approved, when the hold started and when it was due to end.
• Any shortening: the written reason and who signed it.
• When the change was released, by whom, in which payment system, and the reference.

Those are the details an auditor or insurer asks for after a payment goes wrong; the full list is here. The one-page policy template has blanks for the hold length and the exception rule, and the six-step verification guide shows where the hold sits in the sequence.

If you pay vendors by ACH, there is a second reason to write it down. Since June 2026, Nacha's rules require every non-consumer Originator, which includes a business that sends ACH payments to its vendors through its bank, to have "risk-based processes and procedures" to identify payments made under false pretenses, a definition Nacha says covers business email compromise and vendor impersonation (Nacha). The rules do not prescribe a technique. A written callback-and-hold procedure with records is one way to show you have a process; your bank can tell you what it expects to see.

Questions

The vendor rings us during the hold to confirm. Does that count?

Thank them, hang up and call back on the number on file. An inbound call is part of the request, however friendly.

Does a hold replace the second approver?

No. They do different jobs: approval is a second person looking at the evidence, and the hold is time for outside news to arrive. A one-person AP team that cannot have a second approver needs the hold more, not less.

We already paid the new account and now suspect fraud. Where do we start?

Call your bank now and ask for a recall of the funds, then work through the first ten minutes after a "banking details have changed" email.

Next step

BankChangeProof puts the hold into every request. It defaults to 48 hours; you can change the default in Policy, or shorten it at approval for an emergency with a written justification. A request cannot be released before its hold ends. On the Team and Firm plans, the requester and the approver get a reminder when it ends. At release you record the payment system and the reference, and the hold and release appear in the evidence PDF for that change. It does not make the call, verify who owns the account, move money or connect to your ERP or AP system, and it does not prove a payee is legitimate. It is free for 10 vendors.