Bank Change CheckGuide

A supplier says their bank details changed: how to verify it before you pay

Updated 2026-10-13 · by Hieu Tran, written with AI agents and checked against the sources below

The fraud rarely looks like fraud. An attacker gets into the supplier's mailbox, waits for a real invoice in an active thread, and replies from the real address with new ACH or wire details and a reason to hurry. Because the email can be genuine, the only reliable check is outside email.

The callback that counts

1. Use a phone number you already had: the vendor master file, the contract, an invoice from months ago. Never a number, link or contact from the request.
2. Reach your usual contact and ask them to read their new details to you (bank name, last 4 digits, effective date). Don't read the new details to them.
3. Have a second person approve the change in the vendor master before any payment uses it.
4. Write down who called, which number, who confirmed, and when. That record is what auditors and insurers ask for.
5. If the supplier didn't request it: don't reply to the email. Tell IT and the supplier; one of the two mailboxes may be compromised.

Red flags in the email

• Reply-To on a different domain than From, or a display name showing another address.
• A domain one or two characters off the real one (rn for m, 1 for l, a different ending), or one registered in the last few months.
• SPF, DKIM or DMARC failures in the headers. A pass rules out simple spoofing only, not a hacked mailbox at the supplier.
• Urgency (before month end, today), a reason for the change (audit, switched banks), and “we can't take calls, reply by email”.

What Nacha's 2026 fraud-monitoring rules ask

Phase 2 took effect on 19 June 2026 (practically 22 June): every non-consumer ACH originator, third-party service provider and third-party sender must have risk-based processes and procedures reasonably intended to identify entries suspected of being unauthorized or authorized under false pretenses, and review them at least annually. Phase 1 (20 March 2026) covered ODFIs and originators with 6 million or more ACH entries in 2023. The rules don't require screening every entry, and don't change who is liable. A documented bank-change verification step is the obvious place to start.