All guides

4 min read

How to verify a vendor's new bank account before you pay

A vendor emails new bank details. It might be completely genuine: businesses do change banks. It might also be the most common payment scam there is. Here's how to tell the difference without insulting a good vendor or losing a payment to a fraudster.

Step 1: don't use anything from the email

Not the phone number, not the link, not the reply button. If the email is fake, every contact detail in it leads to the scammer. Find the vendor's number in your own records, an old invoice, or their website that you look up yourself.

Step 2: call and use this script

  1. 1"Hi, this is [name] from [company]. We received an email asking us to update your bank details. Did your company send it?"
  2. 2"Great. Could you read me the last 4 digits of the new account, so I can match them?"
  3. 3"Thanks. Who am I speaking with, so I can note it on our side?"

Step 3: never read the digits to them

Ask them to tell you the account digits. If you read yours out loud and ask them to confirm, a scammer on the line will simply say yes.

Step 4: record the check

  • Date and time of the call.
  • The number you called and where it came from.
  • The name of the person who confirmed.
  • The last 4 digits confirmed.

If the vendor says they never sent it

  • Keep paying the old account and tell the vendor their email may be compromised.
  • Don't reply to the fake email.
  • Report it at ic3.gov, and warn anyone else who pays that vendor.