Vendor Bank Details Change Fraud Prevention Controls: Verifying Supplier Account Changes

How Does Vendor Bank Detail Change Fraud Work?

The attacker asks accounts payable to send a real supplier's next payment to a new account. The request imitates ordinary vendor work: it may come from the supplier's genuine but compromised mailbox, from a lookalike domain one character off, or attached to an edited invoice with new remittance details. It often references real purchase orders and past payments, because the attacker has read the email thread. Those details make the request plausible; none of them validates the new account.

The FBI's IC3 describes business email compromise as typically beginning with the compromise of a legitimate business email account through social engineering or intrusion, leading to an unauthorised transfer. Its 2024 Annual Report recorded $2.77 billion in reported BEC losses. GenAI adds a voice. The FBI's public service announcement I-120324 (3 December 2024) warns that criminals use AI-generated audio to impersonate people, which lets an attacker phone accounts payable as the supplier's account manager to confirm the emailed change.

Which Vendor Bank Details Change Fraud Prevention Controls Work?

The controls that work are the ones that do not depend on judging whether the request looks genuine. IC3's own advice is to verify requests to change account information with the intended recipient through a secondary channel. Make that verification a required, recorded step before the vendor master can be edited.

Ask the vendor to confirm the exact beneficiary name, bank, account and effective date, and record who confirmed it, when and through which contact. If your bank or country offers a payee name check, run it on the new account. Then hold or cap the first payment to the new details and confirm receipt with the vendor before larger amounts follow.

The callback only works if the contact on file is trustworthy, so the control starts at vendor onboarding. Record at least two named contacts with phone numbers taken from the signed contract or a call the vendor did not initiate, and re-confirm them each year. A contact added to the vendor master during a change request should be treated as unverified until a known contact confirms it.

Separate the Request, the Vendor Master Change and the Payment

A convincing impersonation succeeds when one person can act on it end to end. Split the work: one person receives and logs the request, a second performs the callback and updates the vendor master, and a third approves the next payment, which should display the changed details clearly. Each handoff is another chance for someone to notice an inconsistency.

Lock vendor master fields for bank details so that changes require a workflow ticket with the verification evidence attached, and report every bank detail change weekly to someone outside accounts payable. Pending changes for several vendors at once, or a change followed by a request to pay early, deserve immediate review.

• Receive and log the request; do not reply on the same thread to verify.
• Call back using the contact in the contract or vendor master.
• Update the vendor master only with verification evidence attached.
• Approve the next payment separately, with changed fields highlighted.
• Cap the first payment and confirm receipt with the vendor.

Should Accounts Payable Screen Change Letters, Calls and Video for Deepfakes?

Screen them when they arrive, but never let the result replace the callback. A signed change letter on letterhead, a voice message from the account manager or a short video meeting can all be fabricated, and NIST's report AI 100-4 (November 2024) reviews detection, provenance and watermarking as separate approaches, each with limits. Missing provenance does not prove a file is fake, and a convincing file does not prove the change is authorised.

Use screening to route the case. A letter or recording flagged as manipulated goes straight to fraud and security, with the original file preserved. One that passes still goes through the full verification path, and the payment hold is justified by incomplete verification rather than by a claim that something is a deepfake.

Where Neural Defend Fits in Accounts Payable

NeuroVerify scores audio, video and face images in one API call and returns a unified risk score with signal-level evidence from six signals, including Face Manipulation Detection and AI Generative Model Analysis. A voice message or recorded video confirming a bank change can be scored as it arrives, and a high score can stop the vendor master change automatically. NeuroCall, in Beta, screens live calls for cloned voices.

For the documents themselves, NeuroDetect takes an authorised change letter, invoice or image into a case, shows explainability heatmaps down to regions, and produces a downloadable forensic report with observations, uncertainty and model context for the analyst, who makes the final call. Neural Defend ranked first of 36 systems on the public VendorBench-100 still-image benchmark (MCC 0.876 against 0.646 for the next vendor); that benchmark does not cover audio or documents, and one of its authors co-wrote Neural Defend's ARCAS 1B paper.

If a Payment Has Already Gone to the Wrong Account

Act within hours. IC3 advises victims to contact the originating bank immediately to request a recall or reversal and a hold harmless letter or letter of indemnity, and to file a detailed complaint at ic3.gov with the banking details. Give the bank the amount, date, source and destination details, and the communication record.

Then contain the wider compromise. Security should review the vendor's and your own mailboxes for forwarding rules and lookalike domains, procurement should confirm the vendor relationship through trusted contacts, and accounts payable should check every other pending bank change. Tell the real vendor: their customers may be receiving the same request.