Vendor Master Bank-Change Fraud Controls: Verifying Supplier Bank Detail Changes

What is vendor master bank-change fraud?

Vendor master bank-change fraud gets a buyer to swap a real supplier's bank account for one that the fraudster controls. In the FBI’s announcement of May 4, 2017, drawing on complaints through 2016, the IC3 reported instances where an apparently spoofed request moved a supplier's remittance location, redirecting all incoming invoice payments. According to the FBI’s June 14, 2016 announcement, such requests arrive by phone, fax or email and closely resemble genuine ones.

This guide covers changes to existing supplier records. Collecting bank details from a new supplier is covered in the risk-tiered guide to supplier onboarding, and the payment path it feeds is set out in the guide to procure-to-pay architecture.

Which process gaps does this fraud exploit?

In AFP’s 2026 survey report, based on 465 treasury practitioners describing 2025, fraudsters mostly posed as vendors or executives to get payment instructions changed. In the same report, two anonymous respondents show the gap: a new bank account for a key vendor was keyed in before Treasury confirmed it, and in another case someone posing as a client sent new details and accounts payable phoned the number in that email.

In AFP’s May 2026 article on respondents' fraud scenarios, several incidents involved teams that skipped the callback or accepted confirmation by email, at times in the very thread that carried the request.

In AFP’s 2024 survey report of treasury practitioners, covering 2023, the authors note that a payment can come from a compromised employee who changes vendor bank details without proper validation in the vendor master process, and one respondent reported harvested login credentials used to try to change bank details.

How should a callback confirm a bank-detail change?

According to the FBI’s 2016 announcement, businesses should set up a phone channel early in the relationship and outside email, and use previously known numbers, not ones in the request. In AFP’s 2026 survey report, 94% of responding organizations said they verify fund transfer requests with a call to an authorized payee contact on a number from official records, and 63% of those users rated it very effective, a self-assessment.

According to AFP’s May 2026 scenario article, an attempt involving a client's altered banking details passed a phone check before inconsistencies exposed it, a compromised vendor mailbox sent documents that looked valid, and a caller posing as a bank used that bank's real number.

In this guide's view, the call should be outbound, to a number from the buyer's records that was set up early in the relationship or last verified before the request and has not changed since, made by someone who did not receive the request, and logged. In the same view, letters and statements showing the new account support the file but do not show who asked.

In the FBI’s May 2017 announcement, the FBI notes that a business contact's sudden request to be reached at a personal email address could be fraudulent. In this guide's view, a change to a supplier's phone numbers, email addresses or named contacts needs the same hold, callback to a previously verified contact, approval and log as a bank change, since whoever replaces the contact on file answers the later call.

Who should receive, verify, approve and release a change?

In a 2014 peer-reviewed model of segregation of duties, read for this guide only in abstract, Kevin Kobelsky defines segregation of duties as allocating work so that no one person can both commit and hide an error or fraud, and his model treats granting and approving system access as separate duties. According to the same abstract, the model requires at least three people for primary separation in IT-supported work and five for secondary separation; in this guide's view, small sites therefore need a compensating review.

In Deloitte’s summary of the COSO framework, segregation of duties is typically part of how control activities are chosen, and management selects alternative controls where separation is not practical. According to the same summary, splitting data entry from authorization lowers risk only if the people involved do not collude.

In the FBI’s 2016 guidance on payment-location changes, the FBI notes that a secondary sign-off by company staff can serve as the second factor. In this guide's view, the recipient, verifier, approver and payment releaser should be four different people, and how those roles cross systems is set out in the procure-to-pay controls guide.

In this guide's view, a multi-site buyer needs one central intake: whoever receives a request at a site or in an AP mailbox forwards it unchanged and never keys or answers it. One verification per supplier then covers every ERP and company-code record, and portal, master-data hub, interface and mass-upload changes get the same hold and callback.

How should urgent change requests be handled?

In AFP’s 2026 survey report, the authors recommend clear policies on standard payment turnaround times, since more time before paying can help prevent fraud, and close examination of immediate or emergency payments. In the FBI’s 2017 announcement, requests for secrecy or quick action are warning signs, and some banks reported holding international wire requests for longer to check them.

In this guide's view, urgency should lengthen the path: nothing is paid to the new account until callback and approval are done, and urgency triggers a second call to another contact on file. In the same view, invoices due meanwhile wait, or go to the account already verified once the supplier's verified contact confirms that it is still open; no source reviewed sets a hold period.

What can automated bank account validation show?

On Nacha’s account validation page, read on November 14, 2026, validation is called a best practice for anyone sending payments. According to the same Nacha page, the rule that requires it, in force since March 19, 2021, covers first-use consumer account details for online consumer debits; on that scope, in this guide's reading, it does not reach a supplier's new account. Under that rule’s method-neutral approach, options include prenotifications, micro-entries and commercial services using pooled data or online banking credentials.

In this guide's view, a validation result does not show who asked for the change, so it cannot replace the callback; file it as one more record.

How should dormant and duplicate supplier records be handled?

No official or research source reviewed covers dormant or duplicate records, so this section is the guide's own analysis. Block records with no payments for a period the buyer sets, so that reactivation needs the same verification as a bank change, and merge or block duplicates that carry other bank details once a named owner confirms the right one. Run these checks on a schedule as part of supplier lifecycle governance after onboarding.

What should the change log prove to an auditor?

According to Deloitte’s COSO summary, control policies should be documented, assessed regularly and reviewed when a specific need arises, and IT should be set up to restrict access and support segregation of duties. In this guide's view, the change log is the record a buyer should be able to show an auditor; the protocol below lists what each step leaves behind.

What should happen if a changed account proves fraudulent?

On the IC3’s BEC page, read on November 14, 2026, the FBI advises asking the originating bank at once for a recall or reversal and a hold harmless or indemnity letter, and filing a detailed IC3 complaint. In this guide's view, treasury makes that bank call; procurement blocks the supplier for payment in every ERP, pulls it from pending payment runs, phones the real supplier on its verified contact and keeps the evidence for finance, security and legal, who own recovery and any legal position.

How will AI agents change bank-detail change verification?