A Supplier Changed Its Payment Details. What Should You Verify?

A supplier can be genuine and an invoice can be correct while the new payment destination is not. Give the change its own verification step.

By Arbab Naseebullah Kasi, Chief Executive Officer - CEO, Feel Worldwide Foundation Inc.

AI-generated illustration: a fictional workshop coordinator independently checking a supplier’s payment-change request.

The amount is familiar. The order arrived. The email carries the supplier’s usual logo and refers to work you really commissioned. Then comes one small instruction: please use our new bank details. For a busy founder or community-project coordinator, it can look like routine administration. Yet the question is no longer only whether the bill should be paid. It is whether the proposed destination has been independently confirmed.

This article is for people who handle supplier payments without a large finance department. It offers a practical workflow to adapt, not a guarantee against fraud or a substitute for your bank’s procedures. The central distinction is simple: approving a purchase, verifying a changed destination, and releasing a payment are different decisions. A convincing invoice should not settle all three.

The invoice is not the whole transaction

The FBI’s business email compromise guidance describes criminals impersonating known senders and gaining access to genuine billing conversations. It recommends verifying changes to account numbers or payment procedures with the person making the request, using in-person contact or a call. That is why familiar wording and a real order number are not enough to resolve a changed-payment request.

A separate problem is a bill for something never ordered. The FTC’s May 2026 small-business warning advises checking invoices closely and maintaining clear purchase and invoice approval procedures. Keep that check, but add a second question for an otherwise valid bill: “What evidence supports this destination?” This prevents a genuine debt from becoming an automatic endorsement of unfamiliar instructions.

Choose the contact route before the urgent message

INTERPOL’s guidance on business email compromise says to verify changes of payment method or bank account through another channel, rather than replying directly to the email. For your workflow, make independence concrete. Use an established contact number from your supplier records, not a number or link newly supplied in the change request. If that route is unavailable, leave the change unresolved while you establish a trustworthy route.

Design a small supplier contact card when the relationship begins. It might identify the business, the usual contact role, an established verification route, and the person on your side who may approve changes. Keep sensitive payment details in the appropriate restricted system, not in a shared workshop spreadsheet. A volunteer organizing room supplies may need to know that an invoice is awaiting verification; they do not need access to banking records.

The conversation should settle the actual change, not merely establish that someone recognizes your organization. Explain that you received revised instructions, ask the established contact to describe what changed and when it applies, and compare the response with the request through your approved process. Do not disclose passwords, login codes, or unnecessary personal information. If details conflict, record the mismatch and stop the change. Uncertainty is a valid result.

A fictional workshop invoice, with two possible endings

Consider this fictional teaching example. Leila coordinates a small community sewing workshop. A regular supplier delivered fabric for a session, and a USD 640 invoice matches the agreed order. On Thursday afternoon, a message says the supplier has changed banks and asks for payment before the weekend. Leila has a telephone number recorded when the relationship began. The message includes a different number, but she does not replace her contact record with it.

Leila marks the invoice “goods confirmed; destination change unverified.” That short status matters. It tells her colleague that she is not disputing the delivery or ignoring the supplier. She uses the established route and reaches the supplier’s accounts contact. In one possible ending, the contact says there was no bank change. Leila preserves the message, does not pay using the new instructions, and alerts the colleague who could otherwise process the same invoice.

In the other ending, the contact confirms a real change. Leila follows the workshop’s agreed documentation and authorization process before updating the payment record. A second authorized colleague checks that the verified details, effective date, and approval belong to this supplier and this invoice. That colleague is not simply checking the arithmetic. The review addresses the evidence for the destination. The example illustrates a control design, not a claim that a phone call or a second person makes fraud impossible.

The practical cost is some staff time and possibly a delayed payment. Leila manages that cost by asking suppliers to notify the team early, setting a verification window before payment day, and giving genuine suppliers a clear explanation: changed instructions must be checked through an established route. A predictable process is easier to cooperate with than an improvised accusation.

Make the pause usable for a very small team

Write a short rule people can actually apply: no payment-record change becomes active solely because a message requests it. Assign someone to verify, someone with authority to approve, and a place to record the result. Where staffing permits, separate those responsibilities. This is a suggested operating design, not a universal legal requirement. Your accountant, bank, or responsible governing body can help fit it to the organization’s obligations and payment tools.

A solo founder cannot create a second employee by writing a policy. Instead, make the separation visible in time and records: receive the request, complete independent verification, document the result, then deliberately return to authorization. Ask your bank what account controls and payment alerts are available. An adviser may help review the process, but do not give an informal helper account access merely to create the appearance of two-person control.

Plan for access needs before an urgent request. If a standard voice call is not accessible, agree an appropriate independent route with the supplier in advance. The objective is independent confirmation, not forcing everyone to use one communication method. Likewise, a colleague should be able to report uncertainty without being mocked for slowing things down. Put the escalation contact and backup decision-maker where the payment handler can find them.

Keep a decision record, not a new data collection

Try a five-field verification note: invoice reference; change requested; independently established contact route; verification outcome and date; authorized decision. Record only what the responsible team needs, and restrict access appropriately. “Spoke with established accounts contact; requested change denied; record not updated” is more useful than “looked suspicious.” It also avoids turning a routine log into an unnecessary store of full account numbers or identity documents.

Rehearse the note with a fictional invoice before using the process under pressure. Ask a colleague to play the supplier, then introduce one complication: the contact is unavailable, the change applies to a different branch, or the requested effective date conflicts with the invoice. The exercise passes when the team can leave the matter unresolved without accidentally releasing payment. Do not use real bank details in the rehearsal.

If money has already moved, act promptly

For suspected business email compromise, the FBI advises immediately contacting your financial institution and requesting that it contact the receiving institution, and reporting through its Internet Crime Complaint Center. INTERPOL also advises promptly alerting the bank, preserving transaction documents and messages, and reporting to local police. The FBI reporting route is U.S.-specific; readers elsewhere should use the appropriate local authorities. Recovery is not assured.

Protecting the email account is another layer. The FBI recommends multifactor authentication where offered. That protection does not replace the payment-change check. For a small organization, the useful combination is account security, an independent verification route, and permission to pause when the evidence is incomplete.

This week, choose one regular supplier and confirm that your team knows how to verify a future change without relying on the change message itself. Then rehearse the five-field note with fictional information. This kind of operating discipline connects with Feel Worldwide Foundation’s Leadership, Institutions & Implementation Capacity pathway. For mission-aligned questions or connections, use Connect With Us, without assuming a particular service or funding offer.

Sources reviewed: October 14, 2026. General educational guidance for small organizations; reporting routes and account controls vary by jurisdiction and provider.