Trust, but Verify the Payee: Handling Late Bank-Detail Requests

A familiar message arrives on a Friday afternoon: the client has changed banks, the old account is closing, and would you kindly send the balance to a new sort code and account number. The tone is friendly, the email chain looks plausible, and the amount matches an invoice already sitting in your ledger. For a small trade firm, the temptation is to update the record and press send. That is precisely the moment payment-diversion fraud is designed to exploit.

The crime is not new, but the execution has improved. Messages are better written, timing is more precise, and the detail often mirrors the way a real client or supplier actually corresponds. The sums involved can be a single invoice or an entire staged payment. Either way, the loss lands on the firm that sent the money, not on the fraudster who received it.

Why trade businesses are exposed

Trade firms tend to run lean. The person who raises the invoice may also be the person who checks the bank feed and releases the payment. Relationships are built on familiarity rather than formal process, and communication moves quickly between site, office and phone. Those are strengths in normal trading. They become vulnerabilities when a payment instruction changes at short notice.

Smaller firms are also more likely to be paying new subcontractors, one-off suppliers or clients with whom the paper trail is thin. Fraudsters know this. They watch publicly available information, monitor email threads where possible, and choose the moment when a payment is expected. The request often arrives just before a payment run, when the pressure to keep the job moving is highest.

The rule that prevents most losses

The single most effective control is a simple rule: no change to bank details is actioned on the basis of an email alone. That applies whether the message comes from a client, a supplier, a subcontractor or a long-standing contact. It applies even when the email address looks correct and the signature block matches. It applies most of all when the request is urgent.

A genuine client will accept a call-back. A fraudster will resist one, invent reasons why it is unnecessary, or try to move the conversation to a different channel. The resistance itself is useful information.

Call-back confirmation, done properly

A call-back only works if it is genuinely independent. Do not ring the number in the email that requested the change. Use a number already held in your records, on the contract, on a previous invoice, or on the company's own website. Ask for a named individual you already deal with, not simply the accounts department. Confirm the new details character by character, including the account name, and record who confirmed them and when.

If the named contact is unavailable, wait. A delay of a day is inconvenient. A payment to the wrong account is considerably worse. Where a client operates through an intermediary, confirm with the client directly rather than relying on the intermediary's assurance.

Two people, one payment

Where staffing allows, separate the person who enters a new payee from the person who authorises the payment. In a firm of two or three, that may mean the owner reviews every new payee while a bookkeeper prepares the payment run. The point is not bureaucracy. It is a second pair of eyes at the only moment when the money can still be stopped.

Keep a simple payment-change register: date, payee, old details, new details, who confirmed the change, and how. It takes a minute to complete and provides a clear record if a payment is later questioned.

Confirmation of Payee and the test transfer

UK banks offer Confirmation of Payee, which checks whether the account name matches the details held by the receiving bank. Use it for every new payee and every change. A mismatch is not a minor administrative point; it is a reason to stop and verify before sending anything.

For a significant first payment to a new or changed account, consider a small test transfer followed by a call to confirm receipt. This is particularly useful with subcontractors and one-off suppliers. It adds a step, but it tests the route before the larger sum follows it.

Wording that sets expectations

Put the rule in writing before it is needed. A short line on invoices and in email footers is enough: bank details will not be changed by email, and any request to do so will be confirmed by telephone using previously held contact details. Ask clients and suppliers to expect a call if their details change. The wording does two things: it deters a casual attempt and it gives your team a standing reason to slow down.

Where bank details must be shared, send them in a document rather than the body of an email, and confirm receipt by telephone. Avoid publishing payment details on public-facing material where they can be harvested and reused.

Red flags worth naming

Urgency is the most common signal, particularly a request timed to a payment deadline. Others include a change of account name as well as number, a reply-to address that differs from the sender, a domain that is almost but not quite right, a sudden reluctance to speak on the phone, and a request to keep the change confidential. None of these proves fraud on its own. Together, they justify a pause.

If a payment has already gone

Act quickly and in order. Call your bank's fraud line immediately and ask for a recall of the payment. Contact the client or supplier on a known number to alert them, without forwarding the suspicious email. Preserve the original message, including full email headers, and keep a written timeline of what was sent, when, and to which account. Report the matter to Action Fraud and inform your insurer. Review whether any other payments to the same payee are due and hold them until the position is clear.

Banks now operate reimbursement rules for authorised push payment fraud, but recovery is not guaranteed and the process takes time. Prevention remains the firm's strongest defence.

Making the check routine

The aim is not to distrust clients. It is to make verification unremarkable, so that a genuine change is confirmed as a matter of course and a fraudulent one has nowhere to go. A call-back, a second pair of eyes and a short line on the invoice will not stop every attempt. They will stop most of them, and they will give the firm a defensible record when the question is asked.