Back to Blog & Insights

Insight

Pause Before You Accept New Vendor Payment Details

A convincing supplier email can redirect a legitimate payment. A short, documented pause gives finance teams time to verify new bank details through a known channel and secure a second approval.

By WWA Editorial Team 4 min read
Finance lead verifying a supplier payment request by phone before approving updated bank instructions

The invoice is due tomorrow. A familiar supplier emails to say it has changed banks and asks you to use the attached payment details. The message includes the right company name, invoice number and tone. It may even continue an existing email conversation. Everything feels routine—except the account receiving your money could belong to someone else.

Compromised or spoofed business email can be used to request invoice payments or altered bank details, and small and medium businesses are among the targets. The practical defence is not a sprawling cybersecurity programme. It is a controlled pause whenever payment instructions change.

Make the pause part of payment work

A payment-change pause separates the invoice deadline from the verification decision. Staff should not confirm new details by replying to the message that requested the change. Instead, they should contact the supplier through a channel already known to the business: a saved telephone number, an established vendor portal or contact information held in existing records.

Do not use the phone number in the change request until it has been checked against an independent record. A convincing email can contain convincing contact details. The central question is simple: are you verifying the request independently, or merely asking the sender to verify itself?

The call can be brief, but it should be specific. Ask the known contact to confirm the account holder, bank details, invoice and reason for the change. If that person cannot confirm the request, stop the payment. Urgency does not turn uncertainty into approval.

Add another decision for material transfers

For transfers your business considers material, require a second approver after independent verification. Each firm can set a threshold appropriate to its payment patterns and cash position. The second person should review the changed instructions, the method used to verify them and the evidence that a known supplier contact confirmed the request.

Record that check in the payment file or accounting workflow. Note who made contact, which established channel was used, when verification occurred, what was confirmed and who gave final approval. The record supports a clear handoff and prevents “someone checked it” from becoming the entire control.

Consider an illustrative example. A small, woman-owned design studio receives revised bank instructions from a regular printer hours before a large invoice is due. The finance lead calls the printer using the number stored in the studio’s supplier record, not the number in the email. The printer says its account has not changed. The studio holds the transfer, saves a note of the call and alerts the supplier to the false request. One pause protects a legitimate operating payment.

Know when prevention becomes response

Verification, second approval and documentation are preventive steps. They apply before money moves. If a payment has already gone to the wrong account, the priority changes from checking to recovery.

Contact the business’s financial institution immediately, using its official phone number, and explain that the transfer may have been misdirected. Speed matters because the bank may be able to begin recovery action. Continue monitoring the relevant accounts and preserve the payment and communication records.

If an email account may have been compromised, check for forwarding rules and connected applications that could let another party read or redirect messages. Alert affected contacts if fraudulent payment-detail changes may have been sent from the account. These actions belong to incident response; they do not replace the earlier payment control.

Questions to ask before releasing funds

  • Did we receive new or amended payment instructions?
  • Did we verify them through a previously known, independent channel?
  • Does this transfer require a second approver?
  • Have we recorded who checked what and when?
  • If money moved incorrectly, has the bank been contacted immediately?

A supplier deadline can create pressure, but it should not erase scrutiny. Make changed bank details a clear trigger: pause, verify independently, obtain the required approval and document the decision. If the transfer has already gone wrong, stop treating it as a routine accounts-payable question and begin recovery at once.

Sources