Verify payment changes through a trusted channel
How should a request to change payment details be checked?
Verify the request through an independently trusted contact channel, rather than using contact details supplied in the change request. Record the request, affected supplier record, verification method and authorised decision before applying a confirmed change.
A message about changed bank details deserves a separate verification step. Familiar names, signatures and an existing email thread can create confidence without proving that a payment instruction is genuine.
Pause the change, not just the payment
ASD describes business email compromise as criminals abusing trust in business processes, including impersonation and compromised email accounts. Treat a bank-detail change as a process event that needs verification.
Contact the supplier through a trusted number or channel already on record. Do not rely only on the contact details supplied in the change request. If you cannot verify the instruction, keep it unresolved.
Build a simple change record
- The request and the date received.
- The existing supplier record being changed.
- The independent verification method.
- The authorised reviewer and decision.
- The date the verified change was applied.
Keep approval responsibilities clear
The person entering a change should know when a second review is needed. Small teams can still define who verifies and who authorises, even if they use a simple checklist rather than a complex purchasing system.
An urgent tone should not remove the verification step. If the supplier says a payment is time-sensitive, explain that the instruction must first be confirmed through the established process.
Use a fictional request to walk through the workflow with your team. Can they find the trusted contact record? Do they know where to raise a suspicious message? The objective is a repeatable pause and check, rather than relying on someone noticing an unusual spelling or signature.
General business-process information. Check the circumstances and seek appropriate professional advice for contractual, legal or specialist decisions.
Further reading
For a corporate enquiry, contact EJN Services.
