The Vendor Bank Detail Change SOP

Purpose

When a supplier says its bank details have changed, this procedure guarantees the shop's next payment reaches the supplier and not a thief, and that the decision can be reconstructed later by anyone who reads the file. Without it, the change is made by whoever opens the email, on the strength of a letter anyone can forge, and the first sign of trouble is a past-due notice from a supplier who never got paid. By then the money has usually been moved out of the receiving account. The principle behind every step is the second-channel rule; this SOP does not re-argue it. See related: The Verify-on-a-Second-Channel Rule.

Scope

Covers any request to change where the shop sends money to an existing supplier, subcontractor, landlord or service provider: new routing or account number, new remit-to address for checks, a switch from check to electronic payment, or a "please pay this invoice to our other account" note. It also covers setting up payment details for a new vendor, which runs from step 2 with the on-file number captured at onboarding.

It does not cover employee direct-deposit changes (same callback logic, run through payroll), a change to your own payout account at a card processor (The Payout Account Change Alert SOP), or a payment that has already gone to a fraudulent account, which is incident response (The First Hour After a Suspected Breach SOP).

Roles and responsibilities

In a shop with one office person, the owner is the approver. If the owner is also the only office person, an outside bookkeeper reviews the call note before the change is entered.

Procedure

Step 1. Log the request and freeze the record. Enter the request in the vendor change log the moment it arrives: date and time, channel (email, letter, phone, portal), sender name and address exactly as shown, and the new details requested. Do not touch the vendor record in the accounting system or the bank's payee list, and keep paying any due invoice to the existing details. Acceptance: one log line, and the vendor record's last-modified date unchanged from before the request. Wrong looks like the record already edited by a well-meaning colleague; stop rule: revert it to the prior details from the log or last month's payment, and tell the owner the same day. Hazard: none physical; the exposure at this step is an attachment or link in the request, so do not open links in it and open an attached letter only in the email's preview pane.

Step 2. Retrieve the verified callback number. Open the vendor record's callback field: a phone number, the person or department it reaches, and the date it was recorded. Acceptance: a number recorded before the request date, from a source other than this request. Wrong looks like a blank field, a number added the same week, or a number that matches the one printed on the change letter; stop rule: do not use it, and source the number from a document the shop received independently and earlier, such as a printed statement or invoice at least 90 days old, with a second person confirming the source before the call. If no such document exists, the call waits until someone visits the supplier's counter or reaches the main line from a printed catalog. Hazard: a number from a web search can be an ad bought against the supplier's name, so a search result is a last resort and is noted as such in the log.

Step 3. Call back and make them tell you the details. Dial the step 2 number, reach accounts receivable, state that this is a standing callback check, and ask an open question: "Have your bank details changed, and what are the new ones?" Do not read the new account number to them. Acceptance: the rep independently confirms the change, names who sent it, gives the effective date, and reads the last four digits of the new account, all matching the request. Wrong looks like a rep who has no record of it, who says "whatever the letter says," who cannot give the digits, or voicemail; stop rule: no confirmation means no change, try twice over two business days, then ask for the controller through the main line, and if the supplier denies sending it, go to the exception path below. Hazard: an inbound call claiming to be the supplier "following up" is not this step, even if caller ID shows the right number; hang up and dial out.

Step 4. Second-person review and entry. The approver, who is not the verifier, reads the log line and the signed call note and checks three things: the number dialled matches the step 2 source, the digits the rep read match the request, and the effective date is plausible. Only then is the change entered, in the bank's payee list and the accounting system, by the approver. Acceptance: two different sets of initials on the call note, and the bank's own dual-approval control (where your bank offers it) showing a different user approving the payee change from the one who keyed it. Wrong looks like the same person on both lines; stop rule: the change is reversed and step 4 re-run by someone else. Hazard: entering details while the request email is open invites copying from the email rather than the call note, so close it and key from the note.

Step 5. Hold for five business days. The new details take effect no sooner than five business days after approval, and the supplier is told the effective date on the step 2 number. Acceptance: the effective date written in the log and the payee flagged inactive until then. Wrong looks like a "small correction" to the new details arriving during the hold, by any channel, or pressure to pay early because an order is waiting; stop rule: any second change restarts the procedure at step 1 and is reported to the owner as a probable attack, since genuine bank changes rarely need correcting within a week. Hazard: the hold is when a compromised supplier mailbox tries again; warn the supplier's AR contact by phone so they can check their own mail.

Step 6. Send a test payment and confirm it on the known channel. After the hold, send a token payment to the new details: the smallest amount your bank allows, or a single low-value invoice. Two business days later, call the step 2 number and ask the supplier to confirm receipt by amount and date. Acceptance: the supplier confirms that exact amount on that date, through the known number, within three business days. Wrong looks like the supplier unable to find it, or a confirmation that arrives by email instead of the phone; stop rule: the main payment does not go, the payee is frozen, and the bank is called the same day to ask whether the token payment can be recalled. Hazard: a confirmation by email proves only that whoever holds the mailbox saw a deposit, which is exactly what a thief holding the mailbox would report.

Step 7. Send the first full payment and check the next statement. Pay the next due invoice to the new details, then check the supplier's following statement. Acceptance: that statement shows the payment applied to the shop's account, on the expected date. Wrong looks like the payment absent from the statement or a past-due notice for that invoice; stop rule: treat it as a completed fraud, call the bank's fraud line within the hour and begin The First Hour After a Suspected Breach SOP. Hazard: none physical; the exposure is delay, because a misdirected payment found weeks later is rarely recoverable.

Step 8. File the record and close. Attach the request, the call note, both approvals, the test confirmation and the statement check to the vendor's change log entry. Do not overwrite the callback field with any number from the request; the field changes only through its own verification. Acceptance: every slot in the record below filled, and the log entry marked closed with a date. Wrong looks like an open entry older than 30 days; stop rule: the owner reviews open entries monthly and closes or escalates each. Hazard: the file holds bank details, so store it where the accounting records live, not in a shared inbox folder.

When the request does not fit

The supplier denies sending it. You have found an attack on the supplier. Tell their AR contact by phone, forward the original as an attachment to the address they give you (never as a reply), keep paying the old details, and warn the office that more attempts may follow.

The supplier refuses callbacks. Some distributors route everything through a portal. Accept changes only inside a portal you reach by typing the address yourself, never from an emailed link.

It arrives by phone. That call is step 1. Take the details, hang up, run step 2 onward.

The record this produces

One change log entry per request: date and time received, channel, sender as displayed, requested details, the step 2 number with its recorded date and source, the call date, the rep's name and the four digits they read, verifier and approver initials, the effective date, the token payment and who confirmed it, and the statement check. The bookkeeper reads it at month end beside the bank's payee changes; the owner reads open entries monthly; the insurer and the bank read it if anything goes wrong, when a dated call note decides whether a claim is argued or paid.

Worked pass: a lumber yard changes banks

A nine-person remodelling shop gets a letter by email from the AR address of its lumber yard on a Tuesday: the yard has moved its account to a new bank after a merger.

• Step 1. Logged 9:12 a.m. Tuesday, email, sender and new details recorded. Vendor record unchanged. Pass.
• Step 2. The callback field is blank; a previous office manager never filled it. Fail. Stop rule applied: the bookkeeper pulls a printed statement from five months earlier, the owner confirms it came by mail, and its AR number is recorded with that source.
• Step 3. Wednesday 8:40 a.m., the bookkeeper calls that number. The rep confirms a bank change after a merger, names her controller as sender, gives an effective date of the first of next month, and reads the last four digits, matching. Pass.
• Step 4. The owner reviews and enters the payee Wednesday afternoon. Two sets of initials; the bank shows a different approver. Pass.
• Step 5. Effective date set five business days out. On Friday an email "from the yard" asks to correct the account number and gives a phone number to call with questions. Restart triggered; the bookkeeper ignores that number, calls the statement number, and the rep confirms no correction was sent. Someone was reading the yard's mail: the letter was genuine and the correction was the attack. Logged, owner told, the yard's AR warned, and the verified change stands with its hold restarted.
• Step 6. Token payment sent after the restarted hold; confirmed on the statement number two days later, exact amount and date. Pass.
• Step 7. First full payment sent; the next statement shows it applied. Pass.
• Step 8. Entry closed 34 days after it opened, four days past the 30-day review line because of the restart; the owner's review notes why.

Re-read against the steps: the blank callback field was the real failure, caught only because step 2 refuses a number it cannot date. Had the office called the number in Friday's email, it would have reached whoever was reading the yard's mail, ready to confirm.

References

• See related: The Verify-on-a-Second-Channel Rule
• See related: Business Email Compromise and Wire Fraud Countermeasures for Trade Businesses
• See related: Setting Up Bank Alerts and Dual Approval for Outgoing Money
• See related: The Office Paid a Fake Supplier Invoice
• FBI Internet Crime Complaint Center (IC3) guidance on business email compromise, which recommends verifying payment changes by phone using previously known numbers