Vendor Bank-Change Fraud: The Payment Controls That Stop a Fake Invoice

Here's an illustrative email. It arrives on a Tuesday from your largest subcontractor's controller, in the same thread as last month's invoice. Their bank is changing. New ACH details attached. Please update before Friday's run. The signature block is right. The tone is right. The only thing wrong is that the controller didn't send it.

Vendor payment fraud prevention comes down to one rule: no payee's bank details change on the strength of an email, ever. Every change gets verified by phone at a number you already had on file, and the first payment to new details is held and confirmed. Those two controls are built to stop a bank-change scam before any money moves.

How big the problem is, and why it hits small firms

The FBI's Internet Crime Complaint Center (IC3) calls this business email compromise (BEC): compromising email or other communication channels to redirect legitimate payments. In the 2025 IC3 Annual Report, BEC drew 24,768 complaints and about $3.05 billion in reported losses, second only to investment fraud by dollars. In 2024 the reported figure was about $2.77 billion. These are only losses people reported to IC3, so the real total is higher.

The same weakness works from the inside. An employee who can edit a vendor's bank details can route a real vendor's payments to an account they control, or pay a vendor that doesn't exist. That's a billing scheme run by an insider, not a hacker, but the control that stops both is the same: nobody gets paid at a new destination without independent verification.

Small service firms are exposed for a simple reason. The person who receives vendor emails, updates the vendor record, and releases payment is often one person. If you haven't split those duties yet, the three-person segregation of duties matrix shows where to start.

What a fraudulent change request tends to look like

None of these features proves fraud, and a good attacker will avoid most of them. Treat any one as a reason to slow down:

• Urgency tied to a payment run. "Please update before Friday" is designed to beat your review.
• A reply inside a real thread. If a vendor's mailbox is compromised, the request comes from their genuine address, in a conversation you recognize.
• A lookalike domain. One swapped letter, or a different top-level domain, in the sender address.
• A new bank in a different state or country from where the vendor operates, with no business reason given.
• Pressure not to call. "Our phones are down this week, just reply here."
• A request to pay a past-due invoice early at the new details.

The controls below work even when the request has none of these signs. That's the point of a rule over judgment.

The five controls, in order of importance

1. Callback to a number you already had

The IC3's BEC guidance recommends using secondary channels or two-factor authentication to verify requests for changes in account information. In practice: call the vendor at the phone number in your vendor file from before the request came in. Never use a number from the email, the attached letter, or the new invoice. If your file has no phone number, get one from a past contract or the vendor's public website, not from the message.

Ask the person to confirm the change without reading the details to them. You read nothing; they tell you the routing and last four digits. Record who you spoke to, when, and what they confirmed.

2. Bank changes only through one channel

Tell vendors in writing that you'll only accept bank changes through a specific form or vendor portal, and that you'll call to confirm. That gives your team a reason to say no to the urgent email without feeling rude. It also makes an email-based request a red flag on its face.

3. Hold the first payment

After a verified change, send the first payment and confirm receipt with the vendor by phone before releasing the next one. For a large vendor, some firms send a small test payment first. The delay is a few days, once per change. Compare that with the cost of discovering the problem when the vendor calls asking why they haven't been paid.

4. Two people release any payment to a new or changed payee

Most business banking platforms let you require a second approver for ACH and wires. At minimum, require it for any payee added or changed in the last 30 days. Then a single compromised login or a single rushed employee can't complete the fraud.

5. Review the change log monthly

Your accounting system or AP tool keeps a record of vendor changes. Pull it monthly and tie each bank-detail change to a callback record. A change with no callback is a finding even if the payment turned out to be legitimate. The same review shows up as check 2 in Bennett's monthly embezzlement checks, because a shell vendor and a hijacked one look identical in the change log.

Bank-change fraud is only one way cash leaves a business without a clear owner. If you'd like to know whether your payment process has others, the Profit & Tax Leak Check is free, runs 20 minutes on approximate figures, and looks at where payment approvals depend on a single person.

A hypothetical: what the controls cost vs. what they save

This example is hypothetical.

A $6M engineering services firm pays 40 vendors a month. About three vendors a year change banks legitimately. Running all five controls costs roughly:

• Callbacks: 3 changes × 15 minutes (including documentation) = 45 minutes a year.
• First-payment holds: 3 × a few days of payment delay.
• Dual release: a second approver spending perhaps 10 minutes per payment run.
• Change log review: 10 minutes × 12 months = 2 hours a year.

Against that: the firm's largest subcontractor bills $85,000 a month. One redirected payment would be $85,000. Two before anyone notices, $170,000. Banks don't always recover misdirected funds, and the vendor still needs to be paid.

There's no ratio to calculate here. Three or four hours a year against a six-figure exposure is not a close call.

The first 24 hours if a payment went to the wrong account

Speed matters more than anything else. The IC3 advises that if you discover a fraudulent transfer, time is of the essence: contact your financial institution immediately and request a recall of the funds, then file a complaint at ic3.gov regardless of the amount. The IC3's Recovery Asset Team works with financial institutions to try to freeze funds, and it works best when complaints arrive quickly.

In order:

1. Call your bank's fraud line, not your relationship manager's email. Ask for a recall and for them to contact the receiving bank.
2. File at ic3.gov with the transaction details: date, amount, receiving bank, account number.
3. Lock the compromised path. If an email account was compromised, reset credentials and check for forwarding rules the attacker may have set.
4. Call the real vendor at the known number. They need to know their email may be compromised, and you still owe them.
5. Notify your insurer. Social engineering and funds-transfer fraud coverage varies widely, and notice deadlines can be short.

Bennett's ten-day cyber incident cash plan covers the separate problem of funding operations while systems are down.

Where these controls sit in your finance function

These five controls are a subset of a broader control design. For the full picture, Bennett's view on internal controls for growing businesses covers approvals, reconciliations, and reporting. When an owner is still the one approving every vendor change, a fractional CFO can take over the approval and review layer so payment controls don't depend on the owner's calendar.

The action for this week: open your vendor list, export every payee with a bank-detail change in the past 12 months, and check whether each has a callback record. If more than one doesn't, that's the gap. Write the callback rule into your AP procedure today, and if you'd like help sizing how much of your monthly outflow runs through single-approver payments, start with a Leak Check.