Vendor bank detail change: definition and how it works in accounts payable

What it means

Vendor bank detail change is the AP term for a request to update the bank account a supplier is paid into. AP teams also see it called a bank account change request or payment redirection. The request may come from a legitimate supplier, from an internal employee acting for the supplier, or from an impostor. That ambiguity is why the term belongs in every AP risk discussion, not only in vendor onboarding.

Changing where money is sent is different from changing an address or a contact name. An ACH payment that reaches the wrong account is difficult to recover, so a bank detail change deserves more scrutiny than routine vendor master data updates. The vendor record may look correct while the payment instruction is false. The risk is highest when the request arrives just before a payment run or carries pressure to act quickly.

Treat every request as a controlled change, whatever the source. Separate who may change bank details from who may release payments, and hold the first payment to a new account for review. Those controls are simple, but they fail when AP treats a Vendor bank detail change as a clerical update rather than a change of payment destination.

How it works in practice

A request usually arrives by email, phone, supplier portal or a note in the vendor record. The AP clerk compares it with the existing vendor record and checks whether the supplier is already known. The common mistake is to reply to the request, use the phone number in the signature, or accept a new contact as proof. The request itself is not evidence.

Verification means calling a contact already on file, never one given in the request. The clerk confirms that the supplier intends to change its bank details and that the person making the request is authorized. The verification is recorded with the request, including who checked and what was confirmed. If the known contact cannot be reached, the change waits.

After verification, the change moves through approval. The person who edits the vendor record should not be the person who releases payments. When the change is approved, the first payment to the new account is held for review. A second person checks the request, the verification and the payment instruction before release.

A small worked situation: a supplier email asks AP to use a new bank account for the next run. The clerk does not use the phone number in the email. The clerk calls the accounts payable contact already on file. That contact confirms the change and gives the same account details, or denies making the request. If the contact denies it, the change is refused and the matter is escalated. If the contact confirms it, the change is approved and the first payment is held for review.

Where it goes wrong

The classic failure is an impostor who imitates a supplier and asks for a Vendor bank detail change. The email looks familiar, the domain is close, and the message says the old account is closing. A clerk who calls the number in the request reaches the impostor. The vendor record is updated, the payment is released, and the money leaves the company.

Internal fraud follows the same path when one employee can both change bank details and release payments. Segregation of duties is not a paperwork exercise; it removes the chance for one person to redirect a payment alone. Shared logins and informal cover during absence weaken that separation.

Vendor master data problems make the fraud easier. Duplicate vendor records, stale contacts and incomplete bank details create confusion about which record is real. An AP team that trusts the newest email rather than the contact already on file is exposed. A change made quietly between payment runs can also miss the review step.

The first payment to a new account is the point of greatest loss. If it is released without review, the recovery effort begins after the money has moved. A Vendor bank detail change should slow the process down, not speed it up.

What to check

First, call a contact already on file, never one given in the request. Confirm the supplier's identity and the bank details directly with that contact. Record who verified the change and when, and keep the evidence with the vendor record.

Second, separate who may change bank details from who may release payments. Limit the people who can approve a change, and require a second check before the first payment to the new account. Country, company and contract rules differ, so follow your written policy and any stricter contract term.

Third, hold the first payment to a new account for review. Check the request, the callback and the approval before release. If the request is urgent, treat urgency as a reason for more checking, not less.

Fourth, watch vendor master data for unexpected changes, duplicate records and changes made just before a payment run. A Vendor bank detail change that cannot be matched to a known contact and a recorded approval should be paused and escalated.

Questions