ProofRelayHow to verify a supplier's bank details properly
Most businesses believe they verify bank details. Most of them are doing something that would not catch a determined fraud — replying to the email, calling the number in the signature block, or asking the person who sent the request to confirm they sent it.
Verification only works when the channel you use to check is independent of the channel the request arrived on. Everything below follows from that one idea.
What counts as an independent channel
A contact detail is independent if it existed before the request arrived and came from somewhere the requester does not control.
- A phone number on an invoice you paid months ago.
- A number from the supplier's website that you navigated to yourself, by typing the address or using a search engine.
- A contact in your own records, entered before this request.
- A number on a signed contract or purchase order.
Everything in the email being checked is chosen by whoever sent it — the phone number, the reply address, the letterhead, the link to "our website". None of it can verify anything.
Why replying to the email proves nothing
If the sender is an impersonator, your reply reaches them and they confirm the details enthusiastically. If the sender is a criminal inside your supplier's real mailbox, your reply reaches them too — and they delete it before the real owner sees it.
In both cases you get a confident yes. That is the trap: replying feels like diligence and produces evidence that reassures you while proving nothing at all.
What to say on the call
Ask them to tell you the details. Do not read the new account number out for confirmation.
This matters more than it sounds. If you read the numbers and ask "is that right?", you invite a yes — which is worthless if you have reached the wrong person, and is exactly what a social engineer is hoping for. If they state the numbers independently and they match, you have learned something real.
Useful wording: "I've received a request to pay invoice [number] to a different account. I'm calling on the number I already had rather than the one in the email. Can you tell me the BSB and account number you want us to use?"
First payments to a brand-new supplier
This is the harder case, and the one most processes ignore. With no previous account on file, the usual "has this changed?" check has nothing to compare against — and a fraudulent first invoice looks identical to a real one.
Establish the contact independently before you need it: from the signed contract, the public business register, or their official website. If the only contact details you hold came from the invoice itself, you have not verified anything — you have asked the document to vouch for itself.
What to record
Write down who called, the number they used, who they spoke to, what was confirmed, and when. Thirty seconds of writing.
This matters for three reasons. If a payment is later disputed, it is the difference between an argument and a file. If your insurer asks whether controls were followed, it is the evidence. And it protects the person who made the call — a documented verification shows they followed the process rather than made a mistake.
Re-verify periodically, not just on change
Confirm the details for your main suppliers once a year as a matter of routine. It takes minutes and it changes the social dynamic entirely: verification becomes something you always do, not an accusation you level at someone who has just asked for something.
That normalisation is worth more than the check itself. The awkwardness of asking is one of the main reasons people skip it at the exact moment it matters.
Common questions
What if I can't reach them on the old number?
Delay the payment until you can. That is the whole answer. A genuine supplier will accept a short delay far more readily than a fraudster will — and an inability to reach them on a previously working number is itself worth treating as a signal.
Is a video call or text message good enough?
A text to a number you already held is reasonable, though weaker than a voice call. A video call is fine if you know the person's face. What matters is not the medium but whether the contact detail was established independently of the request.
The supplier is annoyed that I'm checking. What do I say?
In practice this is rare, and it is worth being direct: "We call to confirm every bank-detail change, for every supplier — it protects both of us." A genuine supplier understands immediately, not least because they are also a target. Reluctance to be verified is itself informative.
Related guides
- Is this invoice a scam? Seven checks before you pay
The seven things worth checking on an invoice that doesn't feel right, and the one check that actually settles it.
- A supplier emailed new bank details. What should you do?
The single most common way businesses lose large sums — and a short, repeatable process that stops it.
- You've paid a scammer. What to do in the first hour
If money has already gone, speed decides the outcome. The order of operations that gives you the best chance.