A supplier emails new bank details just before an invoice is due. The message looks familiar, the amount matches, and someone wants the payment processed quickly. That combination deserves a verification step your finance team can follow even when the request appears to come from a person they know.
Separate the request from its verification
The FBI reports substantial losses from business email compromise. The practical lesson is to separate a payment instruction from the channel used to verify it. A convincing email is still only one source of information. If a mailbox or conversation has been compromised, replying to the same thread may reach the person making the fraudulent request. Verification needs a contact route your organization established independently.
Write down how bank-detail changes are approved. Staff should use a known number from an existing supplier record, rather than a number included in the change request. The person taking that call should explain what is being checked and record the outcome. Decide who can approve the change and whether a second person must review it before money moves. Apply the procedure consistently, including to requests that arrive during a busy payment run.
Keep supplier records consistent
Check how supplier information enters your systems. A shared spreadsheet, accounting application, and email inbox may each hold a different version of the same record. Identify which one is authoritative, who can update it, and how an approved change reaches the others. A clear record of the decision helps the next employee understand why the details changed. It also gives the organization something useful to review after a reported payment concern.
Account security supports the payment process. Ask your IT provider to review access to finance mailboxes and administrator accounts, including multifactor authentication and recovery arrangements. Include the process for departing staff and external bookkeepers. Any change should fit the systems involved and preserve the team's ability to work. A security setting cannot replace a person independently checking a sensitive payment instruction.
Make reporting part of the payment process
Give employees a reporting route that does not require proving fraud first. Someone who notices an unexpected forwarding rule or an unusual payment request should know whom to contact. Agree how finance and IT will coordinate if money has already been sent. Keep bank contacts and escalation instructions available outside the affected mailbox. The response should be discussed before staff need to use it under pressure.
Decide what happens at the payment deadline
Consider a supplier change received on the afternoon a payment is due. A written deadline exception should tell staff who can decide whether to hold the payment while verification is completed. Otherwise the procedure may depend on an employee being willing to challenge an urgent instruction from a senior colleague. Agree the escalation route before a busy payment run makes the decision harder.
Review your payment handoffs
All Ways Better can help you examine the handoff between finance procedures and the systems supporting them. A useful first conversation covers who receives requests, who approves changes, and what evidence the business keeps. Where technical assessment or delivery is needed, we can coordinate an appropriate service introduction. The team doing that work will confirm scope, timing, and pricing with you.
Sign up today to receive a free initial implementation consultation. Bring an anonymized example of a supplier-change request and describe your current approval process. We will follow up to arrange a call about practical improvements. This offer covers the initial conversation; it does not include a financial investigation, a security assessment, or implementation work.
