My supplier emailed new bank details. What should I check before paying?

An invoice arrives in a familiar email thread. The supplier says it has changed banks and asks you to use the new account for today's payment. The logo, invoice amount and signature all look right.

Treat the bank-detail change as a separate verification task, even when the underlying invoice is expected. This is useful for a finance team, a sole trader paying a subcontractor or a small-business owner approving bills between other jobs.

Why a familiar email is not enough

The FBI's business email compromise guidance describes impersonation and compromised email conversations used to redirect money. A request can contain convincing details without coming from someone entitled to change the payment destination.

An urgent deadline is a reason to use a repeatable check. It should not become an exception to that check. You are verifying where the money will go, rather than deciding whether the invoice looks professionally designed.

Use a contact route outside the new message

Call a known supplier contact using a number from your established records, obtained before the suspicious change. If you do not have a trusted number, establish one independently through a reliable source and confirm you have reached the supplier's finance contact. Do not use the replacement number supplied in the same email you are checking.

Explain that you are verifying a change before payment. Ask the contact to confirm whether the request is genuine and provide the account name and details through your agreed verification process. Compare what they confirm with the proposed change rather than asking only, “Is your bank different now?”

If your normal contact is unavailable, leave the change pending and use the supplier's established escalation route. A new person replying within the same questionable email thread does not give you an independent check.

The FBI recommends verifying changes to account numbers or payment procedures with the person making the request, including by phone or in person. The independent route is what makes that check useful.

Keep a short verification record

Use an approved internal location for the record; do not circulate full banking details more widely than necessary. A simple checklist is enough:

Where practical, have a second person check the change and payment setup. In a one-person business, do the supplier-record update and final payment comparison as separate deliberate steps, using your recorded verification rather than memory.

Do not treat a bank's payee-name check as the whole process. Resolve any mismatch or warning before proceeding; even a matching name does not explain whether the supplier genuinely requested this particular change. A small test transfer is also not a substitute for identifying the intended recipient.

A callback script you can use

I'm calling on the number we already have for your business because we received a change of bank details for invoice [reference]. Before updating our records, I need to verify whether your finance team requested the change and confirm the payment details through our usual process. Who is authorised to confirm this?

Once you reach the appropriate person, confirm the change, the invoices it applies to and the agreed details. Never provide your banking password, login code or remote access to someone as part of this check.

If you need to tell the supplier why payment is pending, use a brief factual message through a trusted channel:

We are verifying the payment-detail change before processing invoice [reference]. Please have our established finance contact confirm it through the contact route we already hold. We will update you once the discrepancy is resolved.

For a disputed due date, distinguish the need to verify instructions from the underlying payment obligation. Keep the supplier informed instead of leaving an unexplained delay.

What if I already paid?

Contact your bank immediately using its official app, website or phone number. Explain that you suspect payment diversion and ask about stopping or recalling the transfer. Do not wait for the supplier to finish investigating. Recovery is not guaranteed.

Alert the relevant person in your business and your supplier through a trusted route. Preserve the original messages, invoice, payment reference and verification history. If your account may be compromised, involve whoever manages your email and security.

The UK's NCSC business payment fraud guidance directs affected organisations to contact their bank and IT support; it also links the UK reporting route. In the US, the FBI points victims to IC3. Follow the appropriate reporting route where you are. Official sources checked 15 September 2026.

Keep document review and payment verification separate

A contract can help identify the supplier, payment terms and agreed change process. It cannot establish that a newly emailed account belongs to the right recipient. Contracts.money does not authenticate emails, verify bank ownership or recover payments.

If the amount or included work is unclear as well, use the quote-comparison worksheet. If the supplier's earlier promise is absent from the agreement, clarify the commitment before paying. Neither step replaces checking the destination of the money.