60-Second Vendor Payment Fraud Check
A supplier email asking you to update bank details can redirect every future payment. Use this 60-second check before your AP team approves the change.
Your AP team receives this email:
“Our bank details have changed. Please update your records and process Invoice #INV-2451 today.”
The supplier name is familiar.
The invoice number is correct.
The attached bank letter looks official.
But one email can redirect every future payment to a fraudster.
Before changing any vendor bank details, run this 60-second check.
The 60-Second Check
Ask these five questions:
- Is the request urgent?
- “Pay today,” “before the payment run,” or “do not delay” is a red flag.
- Does it change where money goes?
- A new bank account, IFSC, beneficiary name or payment portal requires verification.
- Is the sender genuinely verified?
- A familiar display name is not proof. Check the actual email domain and sender history.
- Does the request bypass your normal process?
- Requests to skip approval, avoid a call or keep the change confidential are high risk.
- Has someone verified it independently?
- If not, stop. Do not update the vendor master or release payment.
Payment-redirection guidance is consistent: verify any bank-detail change by calling the supplier on a trusted number already on file—not the number printed in the suspicious email or invoice.
The Only Safe Next Step
Call the supplier using the phone number already stored in your vendor master, signed contract or verified onboarding record.
Do not use:
- The number in the email
- The number on the new invoice
- The number in the email signature
- A WhatsApp number supplied in the request
Ask the supplier’s known authorised contact to confirm:
- They requested the change
- The exact bank account and IFSC
- The authorised signatory
- The reason for the change
Then record who verified it, when, and which trusted number was used.
Approve With Two People
No single employee should be able to change a vendor’s bank account and release payment.
Use:
text Maker → verifies and records the change Checker → independently approves the change Payment releaser → releases payment only after approval
A second approver who did not make the verification call should review the request, callback evidence and proposed bank details before the vendor master is updated.
When To Stop Immediately
Pause the payment run if you see:
- A new bank account requested by email
- Urgency or pressure to bypass verification
- A lookalike email domain
- A new finance contact you have never dealt with
- A request to reply only to a new email address
- A payment going to a personal account
- A bank or country that does not match the supplier’s history
Any one red flag requires verification. Two or more should stop the payment until the supplier is independently confirmed.
How ScamShield AI Helps
Forward the suspicious supplier email, invoice, GST notice or WhatsApp payment request to ScamShield AI before your AP team updates the vendor master.
ScamShield AI helps review impersonation signals, suspicious domains, payment-change requests and fraud patterns—so your finance team can make a documented pay-or-stop decision.
Before you pay, check. Forward the supplier email to ScamShield AI.FAQ
Is a supplier invoice enough proof of a bank-detail change?
No. Invoices, bank letters and PDFs can be forged or sent from a compromised mailbox. Verify through a trusted contact channel already stored in your vendor master.
Should we call the number on the invoice?
No. Use a number already stored in your vendor master, signed contract or verified onboarding record—not a number supplied in the suspicious email or attachment.
Who should approve a vendor bank-detail change?
Use dual approval: one person verifies and records the change, while a second authorised person independently reviews and approves it before payment release.