Before the Sort Code Moves: A Director’s Control for Supplier Bank Changes

Few controls in a small company cost as little as a telephone call, and few are skipped as readily. When a supplier writes to say that its bank details have changed, the temptation is to amend the purchase ledger and pay the next invoice. That temptation is precisely what invoice fraud depends upon.

The risk is not limited to large corporates. A convincing email, a familiar signature block and an invoice that matches an existing order are enough. The loss usually lands on the paying company, at least in the first instance, and recovery through the banking system is uncertain.

Why a reply email proves very little

An email confirming new bank details demonstrates only that someone could send an email. If the supplier’s mailbox has been compromised, the fraudster may be reading and answering messages. If the domain has been imitated, the reply may come from an address that differs by a single character. If the thread has been hijacked, the earlier genuine correspondence can sit directly above the fraudulent instruction, which makes the request feel authenticated when it is not.

For that reason, a policy that says “confirm by email” is not a control. It is a formality that gives comfort without evidence.

The shape of the control

The practical answer is a two-call discipline. No change to a supplier’s bank details is actioned until two separate telephone conversations have taken place, with two different people, using two telephone numbers that the company already holds independently of the request.

The first call goes to the supplier’s main switchboard, using the number published on its website or held in its onboarding records. The caller asks for the finance or credit control function and confirms the change with whoever is responsible for supplier payments.

The second call goes to a named contact whose number appears in the company’s own records — a signed contract, a supplier onboarding form, a customer relationship system entry created before the request arrived. The purpose is not to repeat the first call word for word, but to obtain independent corroboration from a second part of the supplier’s organisation.

Both calls are logged: date, time, number dialled, person spoken to, and what was confirmed. The log sits with the change request and is retained.

Numbers you can trust

A telephone number printed in the email requesting the change is not independent. Nor is a mobile number supplied in the same message, or a number read out by the caller when you ask for a direct line.

Acceptable sources include:

• the supplier’s own website, using the main switchboard rather than a contact form;
• a signed contract, order confirmation or credit application held on file;
• an onboarding record completed when the supplier was first set up;
• correspondence that predates the change request and is known to be genuine;
• a customer relationship system entry maintained by the buying team.

Where none of these exists, the change should wait until a reliable number can be established through an independent channel.

What to ask, and what not to say

A useful discipline is to ask the supplier to read the new account number and sort code to you, rather than reading them back for confirmation. Reading numbers aloud invites agreement; asking the supplier to state them requires an independent source at the other end.

Confirm three further points. First, that the account name matches the supplier’s legal entity exactly, not a trading name or a variation. Second, the date from which the new account should be used. Third, whether the previous account has been closed, since a supplier that retains both accounts may be able to accept payment to either while the change is settled.

A confirmation email sent afterwards from an address used in earlier genuine correspondence is useful supporting evidence, but it does not replace either call.

Building it into the ledger and the payment run

A control that depends on individual diligence will eventually fail. It needs to be embedded in the way supplier records and payments are handled.

Supplier bank details should sit in a master-data record that only nominated staff can amend. The person who receives the change request should not be the person who approves it. The accounting system should flag any amended bank record so that payments to that supplier are held until verification is complete.

Before the first payment to a new account, the payer should use Confirmation of Payee and compare the result with the supplier’s legal name. A partial or negative match should stop the payment, not merely prompt a note.

The payment run checklist should include a single question: have all bank changes in this run been verified under the two-call discipline, and is the log attached? A director or senior manager should sign that question off, not simply the preparer.

A quarterly review of the supplier master file is also worthwhile. Look for changes made in the previous three months, duplicates, and any supplier whose bank details differ from those on the original onboarding record. High-value or regularly paid suppliers deserve periodic re-verification even without a change request.

The exceptions that undo it

Most failures occur when the rule is waived. A payment is urgent, the supplier is long-standing, a senior person has asked for it to be processed, or the finance team is short-staffed before a bank holiday.

A written exception process is better than an informal one. Any waiver should require director approval, should still involve at least one independent call, and should be recorded with the reason. If the same exception is requested repeatedly for the same supplier, that is a signal that the supplier record or the process needs attention.

If a payment has already been redirected

Speed matters more than analysis in the first hour.

1. Call the company’s bank immediately on its fraud or payments line, not the general customer number. Ask for a recall of the payment and for the receiving bank to be contacted. Give the payment reference, amount, date and beneficiary details.
2. Record the time of the call, the person spoken to and any reference number issued.
3. Report the matter to Action Fraud and obtain a crime reference number.
4. Notify the company’s insurer, whether under a crime, cyber or commercial policy, and follow any notification conditions in the policy.
5. Preserve the original emails, including full headers, and do not delete or forward them in a way that alters the evidence.
6. Contact the supplier through a known telephone number to establish whether its systems have been compromised and to agree how the outstanding invoices will be handled.
7. Review the mailbox and accounting system for forwarding rules, unusual logins and other supplier records that may have been altered.
8. Consider whether personal data has been affected. If so, the Information Commissioner’s Office expects notification within 72 hours where the threshold is met.

Recovery is not guaranteed. Faster Payments can be recalled where funds remain in the receiving account, but once moved onward the prospects fall sharply. That is why the control belongs before the payment, not after it.

A routine worth the two calls

Before any supplier bank change is actioned: obtain the request in writing; identify two independent telephone numbers from records predating the request; speak to two different people; ask the supplier to state the new details rather than confirm yours; check the account name against the legal entity; log both calls; obtain a second approval; and hold the first payment until Confirmation of Payee has been run.

None of this is sophisticated. It is simply a decision that the company will accept a short delay in exchange for a material reduction in risk. For most UK owners and finance managers, that is a trade worth making.