Checking a supplier's new bank details before paying
How a brokerage should check a supplier's request to change bank accounts before the next payment, and what to do if money has already gone.
By Achekam · · 4 min read · For Insurance businesses in South Africa, Nigeria, Kenya
The e-mail looks exactly like every other one from the brokerage's IT support company: same logo, same signature, same friendly tone. It says the company has changed banks and attaches a letter on its letterhead with the new account details. Please update your records before the next payment. The office manager does, the month's invoice is paid, and weeks later the real IT company calls to ask why it has not been paid.
Changes to supplier bank details are the moment payment fraudsters wait for, because a single update redirects every payment that follows. Insurance brokerages are no exception: they pay regular suppliers, handle client money, and often run lean offices where one person does everything. This piece sets out how to check a change before any money moves, and what to do if it already has.
Why the change request is the risky moment
ICAEW lists supplier red flags for fake invoices: a newly created business with little or no trading history, unexplained changes to bank account details, and suppliers that cannot be independently verified through trusted channels. A change request from a long-standing supplier does not look like a red flag, which is exactly why it works. The fraudster does not need to invent a supplier; they only need to borrow a real one's name for one e-mail.
The request often comes from a compromised mailbox or a look-alike address, at a busy time, with a reason that sounds routine. Treat every change of bank details as unverified until you have checked it yourself, whoever it appears to come from.
Call back on the number you already have
ICAEW advises that when an invoice raises concerns, finance teams should pause processing and verify the supplier independently, using contact details already on record rather than those on the invoice. For a bank detail change, that means:
- Do not reply to the e-mail, and do not call any number in it or in the attached letter.
- Phone the supplier on the number you have used before, from your own records or an old invoice.
- Ask for a named person you have dealt with, and ask them to confirm the change and the new account details, read back to you.
- Write down who you spoke to, when, and what they confirmed.
- Only then update the details, and only after a second person has seen the confirmation.
If the supplier is unreachable on the old number, the change waits. A genuine supplier will understand; a fraudster will push for urgency.
Two people for every beneficiary change
ICAEW recommends preventing fake invoice fraud by tightening supplier onboarding and verification, separating who sets up suppliers, who approves invoices and who makes payments, independently checking any bank detail changes, and using three-way matching, duplicate invoice checks and limits on manual overrides.
In a small brokerage, perfect separation may not be possible, but the change to a supplier's bank details should always involve two people: one who receives and verifies the request, and one who checks the verification and makes or approves the change. If your bank offers dual authorisation for adding or changing beneficiaries, switch it on.
Where the bank details really live
In Achekam, paying a supplier only records the payment, and no bank payment file is produced for suppliers. The money itself moves from your banking app or online banking, to the beneficiary saved there.
That matters for this kind of fraud. The bank details that decide where your money goes are the beneficiary details at your bank, not anything in your accounting records. So the control has to sit where the payment is made: the beneficiary list in your banking platform, and who is allowed to change it.
What Achekam does help with is knowing who your suppliers are. A business keeps one supplier list with duplicate checks by name or VAT number, and quotations, orders and bills pick suppliers from it. A "new" supplier that is really an old one under a slightly different name, or a second record created to receive one payment, is easier to spot when everything goes through one list.
The integrity review's check on shared accounts
A procurement integrity review, sold as its own add-on, raises questions about warning patterns such as competing quotes sharing contact or bank details, or a supplier paid into an employee's bank account. Those are the patterns a bank-detail fraud or an inside job tends to leave behind, and the review raises them for a person to look into, rather than deciding anything itself.
One limit is worth knowing: its check for purchases split under a threshold does nothing until a threshold is set, and the app cannot set one. Do not rely on that particular check.
If money has already gone
ICAEW advises that if a payment on a fake invoice has already gone out, management and the bank should be told immediately, so there is a chance of recovering the money. Speed is everything:
- call your bank's fraud line at once, with the payment details;
- tell the principal or a director straight away;
- warn the real supplier, whose mailbox may be compromised;
- keep every e-mail, letter and record of the change, unaltered;
- report the matter to the police, as your bank advises.
Law firms face the same attack on client payments; stopping payment fraud on client bank details covers their side, and purchase-to-pay checks against fake invoices widens the view to the whole buying process.
ICAEW's guide to identifying and dealing with fake invoices sets out the warning signs and the controls in more detail.
Write the call-back rule into your office procedures this week, tell every person who can change a beneficiary, and check who that is at your bank. The next convincing e-mail will then meet a routine, not a judgement call.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
