Vendor bank-change fraud, also called payment-redirect fraud, happens when a scammer convinces accounts payable to send a payment to a bank account the scammer controls. The moment anyone requests a change to vendor banking details, pause that payment and verify the request through an independent channel before touching payee information. The Internet Crime Complaint Center and the Federal Trade Commission both treat this as urgent.
TL;DR:
- Global identified losses from business email compromise, including payment redirection, topped $55.4 billion from 2013 through 2023, after rising 9% year over year.
- Any warning sign warrants a second look, and two or more should stop payment until independent verification clears the request.
- Pause the payment, call a number from a trusted prior source, ask the vendor to state the new account details, and require a second approver.
- After a payment leaves, contact the originating bank immediately to request a recall and report it promptly to IC3 and the FTC.
- Automated checks that match account names to IBANs can catch mismatches before payment batches run, but they do not replace independent callbacks.
Table of Contents
- What vendor bank change fraud actually costs businesses
- How attackers pull off the vendor bank change scam
- Red flags that should trigger a verification stop
- A verification protocol before you update any payee
- If a payment already went out, act within hours
- Prevention controls worth prioritizing in accounts payable
- Where real-time payee verification fits in the stack
- Process first, tooling second
- A faster way to confirm who's actually on the other end
- FAQ
- Sources
What vendor bank change fraud actually costs businesses
This scam goes by several names: payment redirect fraud, supplier bank details fraud, or simply "the vendor said their bank changed." Whatever the label, the mechanics stay the same: a fraudster impersonates a real supplier and redirects a legitimate invoice payment into a new account.
The scale is why AP leaders can't treat this as a minor risk. Global exposed losses from business email compromise, which includes payment redirection, grew 9% year over year between December 2022 and December 2023, and total identified global losses from 2013 through 2023 topped $55.4 billion. Vendor master files and AP inboxes are attractive targets because they sit at the intersection of trust, routine, and real money movement. A single approved change can divert an entire invoice cycle before anyone notices.
How attackers pull off the vendor bank change scam
Most of these scams start with business email compromise: a fraudster either spoofs a vendor's domain with a near-identical lookalike or actually breaks into the vendor's real email account and waits for an active invoice thread. The FBI's guidance on business email compromise identifies BEC as a top vector for fraudulent transfer requests, and it specifically calls out lookalike domains and compromised accounts as common entry points.
Once inside the conversation, attackers often attach fabricated documentation, a fake W-9, a doctored invoice, or a "new remittance form," to make the switch look routine. They lean on plausible business context: a vendor "updating banks after a merger," switching from Net-30 to Net-60 terms, or claiming an urgent payroll gap. The goal is always the same: make the request feel ordinary enough that nobody double-checks it.
Red flags that should trigger a verification stop
A quick scan for these signals catches most attempts before money moves:
- The request carries urgency or pressure to skip normal approval steps.
- The sender asks AP to keep the change confidential or avoid looping in a manager.
- The email domain is slightly altered, or the message comes from an address not previously used.
- The new routing or account number doesn't match any prior payment history for that vendor.
- The name on the new bank account doesn't match the vendor's legal business name.
- Payment method or terms shift suddenly without a documented business reason.
Any single flag deserves a second look. Two or more together should stop the payment outright until verification clears.
A verification protocol before you update any payee
Treat every bank-change request as unverified until proven otherwise, regardless of how convincing the email thread looks. Build this into a repeatable sequence rather than leaving it to individual judgment:
- Pause the payment and freeze any pending transfer tied to the request.
- Preserve the original email, attachments, and headers without replying from within that thread.
- Contact the vendor using a phone number or contact pulled from a prior, trusted source, never a number listed in the suspicious message.
- Ask the vendor to state the new account details out loud rather than confirming what you read to them.
- Run a payee-name check against the IBAN or account number where that capability is available.
- Require a second, independent approver to sign off on any vendor master data change.
- Log the verification steps taken, including who confirmed what and when.
Pro Tip: Keep a standing list of verified vendor contacts outside your email system so you're never forced to trust a number from the same thread you're trying to verify.
Escalate immediately when the payment is high value, when a vendor has changed banking details more than once in a short period, or when out-of-band verification fails or stalls. None of those situations should get resolved by a single person's judgment call.
If a payment already went out, act within hours
Speed changes outcomes here. Contact your originating bank immediately and request a recall or reversal, giving them the transaction identifiers, amount, and destination account. The sooner that request lands, the better the odds the receiving bank can freeze the funds before they're withdrawn, according to IC3's guidance on BEC losses.
From there:
- File a report with IC3 and with the FTC at ReportFraud.ftc.gov as early as possible; the FTC notes that prompt reporting improves recovery options even though it never guarantees them.
- Preserve every email, invoice, and access log tied to the incident.
- Secure any account that may have been compromised, including resetting credentials and checking for forwarding rules.
- Watch for recovery scams: third parties who contact victims promising to retrieve lost funds for an upfront fee are a documented follow-up scam, and any such offer should be verified independently before paying anyone.
Prevention controls worth prioritizing in accounts payable
Not every control carries equal weight. These sit at the top of the list for reducing payment-redirect risk:
- Require two separate approvers for any change to vendor master banking data, never leaving it to one person's sign-off.
- Set a mandatory out-of-band verification step for any bank-detail change above a defined dollar threshold.
- Use payee-name verification tools, email authentication protocols, and multi-factor authentication across financial systems that touch vendor data.
- Run a periodic audit of the vendor master file to catch stale, duplicate, or unverified entries before they become a liability.
- Train AP staff with regular phishing simulations so urgency-based social engineering gets flagged on sight.
Pro Tip: Build the out-of-band callback step directly into your accounts payable workflow so it's not an optional extra step someone skips when they're busy.
Where real-time payee verification fits in the stack
Technical checks don't replace a phone call to a trusted contact, but they shorten the gap where mistakes happen. Real-time matching of an IBAN against the stated account holder name catches a mismatch in seconds, before a payment batch runs, whether that's a single wire or a bulk CSV of supplier updates. The FBI's own guidance on BEC notes that secondary verification channels remain central, and automated payee-name checks work as a layer on top of that, not a substitute for it.
Process first, tooling second
The strongest fix is still a documented verification habit, not a piece of software. Get the callback step and dual control locked in first, then let automated checks catch what a busy afternoon might miss.
— David
A faster way to confirm who's actually on the other end
Verification protocols work best when the payee check itself takes seconds instead of a day of phone tag. Vopify matches a name against an IBAN in real time, covering individual and business accounts, and supports both single lookups and bulk CSV checks for larger supplier batches, so a mismatch surfaces before a payment leaves the building rather than after.
Running that check as a standing step in your bank-change protocol means the independent verification call still happens, but the account-matching piece no longer depends on manual lookup. Worth testing against your current vendor list to see where the gaps actually are.
FAQ
What is bank account takeover fraud?
Bank account takeover fraud happens when a criminal gains unauthorized access to someone's existing bank account, often through stolen credentials or a compromised email, and uses that access to redirect funds or make unauthorized transfers. It differs from vendor bank-change fraud in that the attacker controls the victim's real account rather than tricking someone into sending money to a new one.
How do you check if a vendor is legitimate?
Confirm the vendor's identity through a phone number or contact pulled from a previous, trusted source, never from the email or document you're trying to verify. Cross-check the business name against the account holder name on any new banking details, and request documentation through a separate channel before processing a change.
What are the top types of payment fraud AP teams see?
Business email compromise, invoice fraud through fake or altered billing documents, and vendor bank-detail changes submitted through spoofed or compromised accounts rank among the most common types reported to the FBI. All three often overlap in a single incident, since a compromised account is frequently the entry point for a fraudulent invoice or bank-change request.
How can I verify an IBAN matches the right account holder?
A real-time payee verification check, like the one Vopify runs, confirms whether a submitted IBAN corresponds to the stated account holder name before a payment goes out. This catches simple mismatches instantly, though it works best alongside an independent phone confirmation rather than replacing it entirely.