A Separate Line: Confirming Changed Payment Details Before Funds Move
Bank detail changes are rarely dramatic. An email arrives from a known client or supplier, politely explaining that their account has moved and asking for future invoices or payments to be sent to a new sort code and account number. The request looks ordinary, the tone is familiar, and the work is already busy. That is precisely why invoice redirection fraud succeeds.
For UK service firms, the risk is not only the loss of a single payment. A successful diversion can damage a client relationship, disrupt supplier terms and consume weeks of investigation. The control that prevents most losses is not technical. It is a disciplined call-back rule, using contact details the firm already holds independently, supported by a second pair of eyes and a clear record.
A small request with a large consequence
Invoice redirection fraud depends on small, believable changes. The attacker does not usually ask for a large transfer. They ask for a routine update: a new beneficiary account, a revised remittance address, a different bank for future payments. If the request arrives before a payment run, the temptation is to make the change quickly and keep the schedule moving.
Legitimate bank changes do happen. Clients restructure accounts, suppliers merge, and finance teams consolidate banking arrangements. The answer is not to refuse all changes. The answer is to verify them through a route that the requester cannot control.
Start with a separate line
The core rule is simple: never verify a bank detail change using contact information supplied in the request. Do not use the email signature, the telephone number in the message or the caller ID on a phone call. Use a number already held in the contract, the client record, the supplier record or the main switchboard.
If the request came by email, do not reply to it. Call the known number. If the request came by telephone, call back on the known number. This is not a sign of distrust. It is the same principle as checking a delivery against the order, not against the driver's note.
The firm should also decide where the independent number is held. A contact record that only exists in a personal inbox is not a control. The number should sit in the customer relationship management system, the finance system or a maintained supplier file, with an owner and a review date.
The four-step call-back routine
1. Stop the payment and isolate the request
When a bank change arrives, the payment should be held until verification is complete. The request should be logged, but master data should not be changed. Finance should be told that a change is pending, and the account owner should be informed. If a payment is due on the same day, the hold should be explicit rather than assumed.
2. Call back on an independently held number
Call the number held in the firm's own records. Ask for a named contact who is known to the account, not simply anyone who answers. Confirm the request in clear terms: which entity, which account, which effective date and which payments are affected. Where possible, avoid reading out full account details; use the last four digits as a reference and ask the contact to confirm the rest.
If the named contact cannot be reached, do not accept a verbal assurance from another person unless that person is authorised and identifiable. Escalate instead.
3. Apply a two-person check
A single person should not both verify and approve a bank change. Use a maker-checker arrangement: one person makes the call and records the outcome, and a second person reviews the evidence before the record is updated. In a small team, the second check may sit with a director or another senior colleague, but it should still be separate from the person making the request.
The second check is not a formality. It confirms that the number used was independently held, that the contact was the right person, that the old and new details were recorded accurately and that the payment hold was respected.
4. Record and update once
Only after the call-back and second check should the master record be changed. The record should show the date and time of the request, the method used, the independent number dialled, the person spoken to, the outcome, the approver and the effective date. Store the old and new details, masking sensitive digits where full details are not needed. Notify finance and the account owner, and confirm the change to the client or supplier through the same independently held channel rather than by replying to the original email.
When the change is genuine and urgent
Urgency is not a reason to bypass the rule. A legitimate client with a genuine deadline will understand a short delay for verification. The routine should be fast enough to avoid unnecessary friction: a named contact list, a clear script and a second checker who is available during payment periods.
If the team cannot verify the change before a payment deadline, the payment should not be released. The matter should be escalated to a manager and, where fraud is suspected, reported through the appropriate channels, including Action Fraud. Keeping the original message and the call-back record will help any later investigation.
Make the rule visible
A call-back rule only works if it is known and practised. Include it in finance induction, client onboarding and supplier setup. Add a short prompt to the payment approval process. Review bank change records each quarter to confirm that independent numbers were used and that the two-person check was completed.
A periodic test is also useful. Ask a colleague to send a simulated bank change request through normal channels and see whether the team holds the payment and calls the known number. The exercise is quick, and it reveals more than a policy document.
A rule that protects the relationship
Confirming a bank change is not an accusation. It is a routine form of care. The firm is protecting the client's money, the supplier's payment and its own reputation. A separate line, a second check and a clear record turn a plausible email into a controlled event. That is the standard UK service teams should expect.
