How to Verify a Vendor’s Bank Details

A familiar vendor emails an invoice with new bank details. Before updating the payment record, contact the vendor through an established, independently verified channel. Do not use the phone number or link in the change request to verify that same request.

The change might be genuine. But a correct invoice amount, familiar logo, or existing email conversation does not prove the new account belongs to the vendor. For a landlord or property manager, confirming the work and confirming where the money goes are separate jobs.

The invoice looks familiar. The payment instructions changed.

Imagine a property manager preparing to pay an approved landscaping invoice. The work is complete, the amount matches, and the vendor’s name is familiar. Then this message arrives. The example is fictional and contains no real vendor or bank details.

You do not have to decide whether the email is fraudulent by looking at it. You need to verify the requested change before acting on it. Do not update the vendor record or send money to the new destination while that verification is unresolved.

The FBI’s business email compromise guidance describes messages that appear to come from known sources, including vendors. It explains that criminals may imitate addresses or gain access to legitimate billing conversations. That is why a familiar email thread is useful context, but not independent confirmation.

Use a contact you trusted before this message arrived

Call the vendor using an established contact from your verified records. Reach the person authorized to confirm payment changes. If you need to find the business independently, navigate to its established official channel yourself, rather than following the message’s link or relying on its signature.

A number printed on the new invoice is part of the request you are checking. Replying to the email asks the same channel to vouch for itself. Neither provides an independent check. The FBI recommends independently finding contact details and verifying changes in account numbers or payment procedures directly with the person making the request.

We received a request to change the payment details for your invoice. Before we update our records, can you confirm whether your business requested the change and connect us with the person authorized to verify it?

Use your approved secure process to confirm the actual destination with that authorized contact. Confirming only that “something changed” is not enough. Do not send passwords, one-time security codes, or your own bank login information to complete this check.

If you recently took over management and cannot establish a trusted contact, resolve that gap first. Our property management handover guide explains how to confirm authorized contacts and request the relevant vendor records. An unfamiliar person’s urgency is not a substitute for verification.

The next step depends on what the vendor confirms

These are practical operating steps, not a guarantee against fraud. Keep sensitive banking data in the system approved for it. A general task note can record the verification and approval without copying full account details into a shared chat or email chain.

If the payment has already been sent

Contact your financial institution immediately through its official fraud or payment-support channel. Explain that the payment may have been diverted, provide the transaction details securely, and ask what action is available. Do this promptly rather than waiting for an internal investigation to finish.

The FBI advises contacting your financial institution immediately and requesting that it contact the institution that received the transfer. It also directs victims to report business email compromise to the Internet Crime Complaint Center, IC3. A bank contact or report does not guarantee that money can be recovered.

Notify the appropriate person in your organization and the genuine vendor through verified contacts. Preserve the original emails and payment records for the bank, investigators, and your security support. If you suspect an email account was accessed, involve the responsible account administrator or IT provider to assess and secure it. Do not treat a second payment as an automatic fix before confirming what happened and obtaining approval.

Make verification routine, not personal

Apply the same verification rule to every payment-detail change, including requests from long-standing vendors. Explain the process when establishing the relationship, so a callback is an expected part of handling a change rather than an accusation.

The FTC’s business email imposter guidance explains why messages that appear to come from a company can still be impersonation. Keep that distinction in mind when reviewing a convincing invoice: familiar presentation and verified authority are different things.

The same distinction matters when someone copies your rental listing. Matching photos do not establish who is authorized to collect money. With vendor payments, matching invoice details do not establish who controls the destination account.

Before paying changed instructions, verify the change through a trusted channel, document the confirmation, and follow the approval process. A real invoice still needs the right payee.