A misdirected payment happens when money leaves your account and lands in one that does not belong to the person you meant to pay. The cause is either a typo or a fraudster who swapped the bank details. You prevent both the same way: confirm every change through a channel you already trust, split the duties so no one person can change and release a payment, and check that the account holder name matches the account number before the money moves. This guide shows how, step by step.
TL;DR
- Most misdirected business payments start with a changed set of bank details, either a keying error or a fraudulent request that looks like it came from a supplier.
- Verify every change by calling a number already in your records, never one in the request itself.
- Separate the person who edits vendor data from the person who approves and releases payment.
- Add an account-holder name check before release. For euro (SEPA) and several Asian payees, we built Vopify to do that in about two seconds.
- If a wrong payment goes out, call your bank for a recall request the same day and file a report at ic3.gov.
Table of Contents
- What a misdirected payment is, and how it happens
- Warning signs that bank details have been tampered with
- Verify changes through a channel you already trust
- Controls that stop one person from causing a loss
- Check the payee name against the account before you pay
- Our perspective
- Using Vopify in your payment workflow
- What to do when a payment already went to the wrong account
- Putting it together: a one-page prevention routine
- FAQ
- Sources
What a misdirected payment is, and how it happens
There are two families of misdirected payment, and they need slightly different defenses.
Honest mistakes. Someone mistypes an account number, picks the wrong vendor record, or pastes the wrong row from a spreadsheet. The money goes to a stranger, and getting it back depends on that stranger's cooperation.
Deliberate redirection. A criminal convinces you to pay them instead of the real supplier. In the UK, the National Crime Agency describes payment diversion fraud, also called BEC or mandate fraud, as criminals impersonating others, creating or amending invoices and diverting payments to accounts they control. The mechanics are the same in the US.
The scale in the US is large. The FBI's Internet Crime Complaint Center logged close to $2.8 billion in business email compromise losses in 2024, and nearly $8.5 billion across 2022 to 2024, according to Nacha's summary of the IC3 report.
The attack usually runs like this:
- The criminal gets into a supplier's mailbox, or spoofs it with a lookalike domain. A UK consumer-finance guide notes they may reuse a genuine email thread to make the request look credible.
- They send a polite note: our bank has changed, please use the new details from now on.
- Someone in accounts payable updates the vendor master file.
- The next scheduled payment runs, on time and fully approved, to the wrong account.
Notice what failed: not the approval workflow, which worked perfectly, but the trust placed in a single unverified message. That is why prevention concentrates on the moment bank details change.
Warning signs that bank details have been tampered with
Train your team to treat any bank change request as a risk event. The North Carolina Office of State Controller lists the signals to watch for:
- Misspellings or unusual grammar
- Changed contact details, or email domains that are similar to the real one but different
- Urgency or pressure
- Requests to skip normal procedures
- Requests to communicate only by email
The FBI's Albuquerque field office points to the same pattern: unexplained urgency and last-minute changes to wire instructions or recipient account information.
One more flag no checklist prints: a new account that sits in a different country, or at a different bank type, than the supplier's history. A US landscaping vendor that suddenly asks to be paid to a foreign account deserves a phone call before anything else.
Verify changes through a channel you already trust
This is the single most effective habit. The state guidance is clear that AP should confirm changes using contact information from your own records or obtained independently, never the details in the request. You are confirming that the requester is authorized, that the supplier really initiated the change, and that the banking information is accurate.
In practice:
- Call back on a known number. Use the phone number from the signed contract or the original onboarding file. Not the number in the email signature, and not a number the new message supplies.
- Make the supplier do the paperwork. The same guidance recommends that suppliers complete enrollment or banking change forms themselves rather than your staff keying them in on their behalf.
- Hold the next payment. A short cooling-off period after any change gives the callback time to happen. Our article on why AP must hold payment first covers how to set that rule without delaying honest suppliers.
- Log who verified, how, and when. If something goes wrong later, that record is the first thing your bank and investigators will ask for.
The same discipline applies to your internal reconciliation. A clear monthly bank reconciliation process makes an unexpected payee or an odd amount visible within weeks instead of quarters, which narrows the window in which a recall is still realistic.
If you are building this from scratch, start from onboarding. Our supplier onboarding checklist lists what to collect and confirm before a vendor ever receives a first payment.
Controls that stop one person from causing a loss
Verification fails when a single employee can both change a vendor record and release the money. Separation of duties removes that single point of failure.
NetSuite's accounts payable fraud guide recommends separating bookkeeping from check-signing and bank reconciliation, and notes that the same person should not cut checks, sign them and reconcile the bank accounts. It also lists phishing education and verification of changes to invoices, bank-deposit information and contact information among effective controls. RSM adds a sober observation: segregation of duties is basic, yet many companies have breakdowns in this control that create openings for fraud.
A workable minimum for a small or midsize finance team:
| Control | Who does it | What it prevents |
|---|---|---|
| Edit vendor bank details | AP specialist | Nothing alone; it is the risky step |
| Callback verification | A second person, not the editor | Fake change requests |
| Name-to-account check | System or second person | Typos and impersonation accounts |
| Payment approval | Controller or manager | Unusual amounts or new payees |
| Bank reconciliation | Someone outside AP | Missed anomalies |
Add a few rules that cost nothing:
- Any change to bank details triggers a review of the next payment to that vendor, even if it is routine.
- New payees above a set amount need a named second approver.
- Staff who handle vendor data get short, regular training on spoofed emails, using real examples from your own inbox.
For a wider view of the control environment, see our guide to preventing payment fraud.
Check the payee name against the account before you pay
A callback proves the supplier asked for a change. It does not prove that the account you are about to pay belongs to that supplier. A name-to-account check closes that gap by asking the receiving bank's network whether the account holder name matches what you have on file.
This is now standard thinking in Europe. Under the EU Instant Payments Regulation, payment providers in the euro area must offer a verification-of-payee check on SEPA transfers, so a mismatch is flagged before the payment is sent. If you pay European suppliers, that same logic is worth applying to your own payment run.
Here is how this fits a US finance team:
- Domestic US payments (ACH, wires, checks). Name matching works differently here, and Vopify does not cover US domestic accounts. Rely on callback verification, a first-payment microdeposit or your bank's own account validation tools, and the controls above.
- Euro suppliers. If a vendor gives you an IBAN, a name-to-IBAN check tells you whether it matches the legal name on your vendor record.
- Payees in India, Indonesia, South Korea or China (Alipay). Name-to-account lookups are also possible on those networks.
Our guides on validating vendor bank accounts and real-time bank account verification go into the options in more detail. If you use accounting software, the QuickBooks vendor bank verification comparison shows how the built-in method stacks up.
Match verification effort to risk
You do not need to run the heaviest check on every payment. A sensible tiering:
- Every new payee and every changed account: full callback plus name-to-account check.
- Large or unusual payments to existing vendors: a name check before release.
- Small, steady payments to long-standing vendors: periodic re-verification, for example quarterly.
We describe this approach in risk-based verification for AP teams.
Our perspective
Most AP teams we talk to already have a callback rule. What they lack is a fast way to confirm that the account itself belongs to the named company. A phone call proves a person said yes. It does not prove the IBAN matches the legal entity.
That is why we built Vopify around one narrow job: you enter a name and an IBAN, and you get a match result in under two seconds, for individuals and businesses, with no contract needed to start. Our platform has processed over 10,000 verifications across 20 Eurozone countries, and it also covers India, Indonesia, South Korea and China (Alipay).
We think the check belongs in the payment run itself, as a routine step, not an emergency tool after something looks wrong. A mismatch costs a minute to investigate. A misdirected payment costs a recall, a bank call and a very awkward conversation with the real supplier.
David
Using Vopify in your payment workflow
If you pay suppliers by IBAN, Vopify gives your team an instant account-holder check without integration work or a long contract. You can look up a single payee, or upload a CSV of supplier data to check a whole vendor file at once with bulk IBAN verification.
Pricing is published on our site: a single verification costs $0.70 to $1.00, and subscriptions are Starter at $240 per month, Growth at $750 per month and Scale at $2,000 per month. Teams that want to check payees from an AI assistant can look at Vopify MCP. API integration for high-volume programmatic checks is planned. Coverage details for each network are on our supported networks page.
What to do when a payment already went to the wrong account
Speed matters more than anything else here. The FBI advises that if you discover a fraudulent payment, you contact your financial institution immediately to request a recall of the funds and file a complaint with the IC3 at ic3.gov. The UK's National Crime Agency gives the same advice to businesses in its own country: act fast and report to the bank for the best chance of recovery.
A practical first-hour checklist:
- Call your bank's fraud or treasury desk and ask for a recall or hold on the payment. Give them the date, amount, and receiving account details.
- Preserve the original emails, headers and your verification log.
- File the IC3 complaint.
- Contact the real supplier through a known number so they can confirm the invoice is unpaid.
- Freeze further payments to the changed account and review other recent vendor changes.
- Tell your insurer or broker if you carry crime or cyber coverage, since policies often have notification deadlines.
For honest typos, the recall request also goes through your bank, but the recipient has to agree to return the money, so expect a longer path. This is exactly why checking before sending is cheaper than any recovery.
Putting it together: a one-page prevention routine
- At onboarding: supplier completes the forms; you verify the account with a name-to-account check where coverage exists.
- On any change: callback to a number on file, second-person confirmation, hold the next payment.
- Before release: approver sees the payee name, account and a flag if details changed recently.
- After release: reconciliation by someone outside AP, with exceptions reviewed monthly.
- Every year: retrain staff and test the process with a simulated fake change request.
If you want a deeper look at one common attack, our piece on BEC controls and name-to-IBAN checks walks through it, and vendor impersonation fraud covers the lookalike-supplier variant. For definitions, see what is payment fraud.
FAQ
Can I get my money back if I sent it to the wrong account?
Sometimes. Contact your bank immediately and request a recall, then file at ic3.gov if fraud is involved. Chances fall quickly with time, and for an honest error the recipient or their bank must usually agree to return the funds.
Can a wire transfer be reversed?
Not in the way a card charge can. A wire can only be recalled by asking your bank to contact the receiving bank, and success depends on whether the funds are still in the account. Report within hours, not days.
How do I stop vendor bank details from being changed fraudulently?
Require a callback to a number already in your records, make the supplier submit the change form themselves, and have a second person approve the edit. Hold the next payment until verification is logged.
Does Vopify check US bank accounts?
No. Vopify verifies payees in the euro area (SEPA), India, Indonesia, South Korea and China (Alipay). For US domestic payments, rely on callback verification, separation of duties and your bank's validation tools.
Sources
- National Crime Agency: payment diversion fraud
- Nacha: FBI IC3 business email compromise losses
- Financial.org.uk: invoice redirection
- NC Office of State Controller: supplier payment and banking information best practices
- FBI Albuquerque: business email compromise alert
- NetSuite: accounts payable fraud guide
- RSM: three ways to combat vendor fraud