How to verify a vendor bank account change, step by step

The six steps

1. Treat the email as a request, not an instruction. Read the sender's domain character by character, not just the display name. Note any urgency language ("process today," "final notice") — legitimate vendors rarely need same-day changes.

2. Record the requested change exactly. New bank name, and the last four digits of the new account — never store the full number.

3. Call back on the number already on file — from the vendor master record, a signed contract, or a prior invoice, never a number provided in the email itself.

4. Log the outcome of that call. There are four possible outcomes: confirmed by the vendor, denied (the vendor never sent the request), unreachable, or no answer.

5. Route for a second approval from someone who was not the one who received the original email.

6. Apply a cooling-off hold before the first payment goes out on the new details, even after a clean callback.

Why the callback is the step that matters

A finance team on r/Accounting described nearly losing a six-figure wire transfer to exactly this kind of request, and the lesson they took from it was blunt: "Always call the official number in the vendor master, we lost 300K over that one" (r/Accounting). The same thread includes a detail worth taking seriously if you carry cyber insurance: "Their insurance claim was subsequently denied because they didn't call to verify the wire instructions." The callback is not a formality the policy requires — for some policies, it is the difference between a claim being paid and denied.

The rule that follows from this, stated by the same thread, is the whole procedure in one line: "any banking change requires a callback using a number from our vendor master, plus dual approval and a short cooling off period before payment."

What if the request turns out to be genuine?

Most of them are. An MSP describes the fix they landed on after enough of these requests turned out to be real vendors who had simply forgotten to use the proper channel: "now have a portal per vendor where they make account/payment changes. If any staff member gets a request in email we know it's either the vendor forgetting or a BEC attempt" (r/msp). Either way — forgetful vendor or attack — an email is never itself the channel that gets a bank change accepted. It only starts the verification.

What the finished record contains

When the hold ends and the change is applied, the record should show, in one place: the original request, the callback log with its outcome, who gave the second approval, the hold period observed, and who released the payment. That is what turns "we verified it" into something you can show an auditor, an insurer, or your own finance leadership months later without reconstructing it from memory.

Where the procedure usually breaks down

• Calling a number from the email's signature block. A signature line is text in the same email being verified; it proves nothing on its own. The number has to come from a record your organization controlled before this request arrived.
• Letting the same person approve their own callback. The second approval exists specifically to catch a mistake or a compromise the first person missed. If one person can complete every step, there is no second check at all.
• Skipping the hold when the request says "urgent." Urgency is a pressure tactic in a large share of these attempts, not a legitimate reason to skip a control. Treat "urgent" as a signal to slow down, not to speed up.
• Not logging a denied or unreachable callback. A request that failed verification is exactly the record you want if the same vendor's name gets used again in a future attempt.

Deciding who the second approver is, in advance

The procedure only works under pressure if the second approver is already named before a request ever arrives — not worked out in the moment by whoever happens to be at their desk. For a small team this might be a single named backup approver; for a firm handling changes across multiple clients, it usually means naming an approver per client relationship ahead of time, so nobody has to guess who is allowed to sign off when a request lands on a Friday afternoon.

Questions

What if the vendor's number on file is out of date?

Update it through a separate, verified channel first — never by trusting a number supplied in the same email asking for the bank change.

Is a callback really necessary if the email looks legitimate?

Yes. A convincing email is exactly what a successful attack looks like; the callback is the step that does not rely on the email being trustworthy.

Does this replace Trustpair, Bill.com, or my bank's own verification service?

No. Those handle other parts of payment processing. This is the specific procedure for verifying a change to where money goes, whichever system eventually sends the payment.

Next step

BankChangeProof logs each of these six steps as you go — the request, the callback outcome, the second approval, and the hold — and produces one evidence PDF per vendor bank-detail change.