What to do when a vendor asks to change their bank details

Do not pay the new account until you verify the change by calling the vendor on a phone number you already hold, never one from the email. The Canadian Anti-Fraud Centre advises verifying every payment request, especially a change in banking details. Hold pending payments, then check whether your mailbox or the vendor's has been compromised.

• It arrives by email, especially as a reply in an existing thread or with a new PDF 'letter from the bank'.
• It's urgent: an overdue invoice, an audit, a bank 'freeze' or a deadline.
• The new account is at a different bank, in a different province or country, or in a name that doesn't quite match the vendor's legal name.
• The sender's address is slightly off (an extra letter, a different domain ending) or the reply-to address differs from the from address.
• The person asks you not to call, or says they're travelling and can only use email.
• The writing style, signature or logo differs from earlier messages.

1. 01

   Find the number yourself

   Use the phone number in your vendor master file, a signed contract, or a past invoice you already trust. Never use the number in the change request or its signature.

2. 02

   Speak to someone you know

   Ask your usual contact, or their accounts receivable team, to confirm the change and read back the new details.

3. 03

   Confirm the specifics

   Institution, transit and account numbers should match exactly. Ask why the change is happening.

4. 04

   Record it

   Log who called whom, when, at what number, and what was confirmed. Attach it to the vendor record.

5. 05

   Second approval

   Have a second person approve the change before it goes into your payment system.

Put any scheduled or pending payment to that vendor on hold until the change is verified. If the request turns out to be fraudulent, also check whether any payment already went to the new details; if so, call your bank's fraud line immediately and follow What to do if you sent a payment to a fraudster.

A short delay is easy to explain to a real vendor. A payment to a fraudster often can't be undone.

If the request came from the vendor's genuine address, tell them by phone: their mailbox is probably compromised and other customers may be targeted. If it came in a thread that only you and the vendor saw, check your own side too. Microsoft's incident response playbooks for phishing and compromised accounts list what to look for: unfamiliar sign-ins, inbox rules that hide replies, and external forwarding. See What to do if a Microsoft 365 account is hacked.

• Keep the fraudulent email with full headers, and any attachments, unaltered.
• Report attempted fraud to the Canadian Anti-Fraud Centre at reportcyberandfraud.canada.ca; attempts help police link cases even when no money was lost.
• If money was lost, also report to local police and your insurer.
• Tell your staff: a blocked attempt is a good training example.

• Written rule: no banking change without a verified callback, regardless of who asks or how urgent it is, including requests that appear to come from your own executives.
• Separate duties: the person who changes vendor banking details shouldn't be the person who releases payments.
• A cooling-off period, or a small test payment confirmed by phone, before large payments to newly changed accounts.
• Bank-side controls: positive pay, payee verification and dual approval in online banking where your bank offers them.
• Annual refresher for accounts payable staff. A written procedure is available at A payment verification procedure to stop wire fraud.