Stopping Vendor Bank-Change Fraud

Here is the email. It comes from a vendor you have paid for years. The message is polite and unremarkable: the company has changed banks, and could you please update their account details for the next payment. New routing number, new account number, maybe an attached letter on company letterhead. Nothing about it looks alarming.

This is vendor bank-change fraud, and it is among the most lucrative scams targeting accounts payable. One successful request reroutes a real, large, legitimate payment straight to a criminal's account. No fake invoice, no fictitious vendor — just a genuine payment sent to the wrong place. This article covers how the scam works, why it keeps succeeding, and the single control that reliably defeats it.

How the Scam Works

The mechanics are simple, which is what makes it dangerous. The fraudster gets access to — or convincingly imitates — a vendor's email, often after a separate phishing breach of that vendor. They watch for, or simply wait for, a normal billing cycle. Then they send your AP team a request to update the vendor's banking details. If AP makes the change, the next legitimate invoice from that real vendor gets paid into the fraudster's account. The theft is often discovered only weeks later, when the real vendor asks where their money is.

Why It Keeps Working

Bank-change fraud succeeds because it does not look like fraud. There is no suspicious invoice to catch — the invoice is real. The request comes from a known vendor, sometimes from their actual compromised email account, so it passes every instinct AP has been trained to trust. And it exploits ordinary helpfulness: updating a vendor's bank details feels like routine admin, the kind of small favor a good AP clerk does without a second thought. The scam weaponizes exactly that helpfulness.

The One Control That Stops It: Out-of-Band Verification

There is one control that defeats this fraud, and it is not complicated: never change vendor bank details based on the request alone. Verify every change by calling the vendor back on a phone number you already have on file — not a number from the request email, not a number in the attached letter. This is 'out-of-band' verification: confirming through a separate channel the fraudster does not control. If the request is fake, a 90-second phone call to the real vendor exposes it instantly.

Build the Change Into a Workflow, Not an Email

Out-of-band verification only works if it always happens, and 'always' cannot depend on a busy clerk remembering a policy under deadline pressure. The change has to be a workflow with mandatory steps: a bank-detail change cannot be saved until the verification is recorded — who was called, at what number, on what date. And the change should route the next payment to a different approver, so the person who altered the account is not the one who releases money to it.

Red Flags in a Bank-Change Request

Verification catches every fraudulent request, but these signals mean treat it with particular care.

“We got the email — right vendor, right logo, right tone. Our clerk did what the policy said and called the number we already had on file. The real vendor had never sent it. That one phone call saved a six-figure payment from leaving the building.”

— Controller, electrical contractor

Closing the Bank-Change Hole

Covinly treats a vendor bank-detail change as a controlled event, not an email edit: the change is logged as a distinct action, verification must be recorded before it can take effect, the next payment routes to a separate approver, and the full history is preserved in the audit trail. The control is enforced by the workflow, so it holds during the busy payment run when a manual policy is most likely to slip.

Vendor bank-change fraud is not stopped by being more suspicious — it is stopped by one unbreakable habit: verify every change out-of-band, on a number you already had. Build that into the workflow so it cannot be skipped, and the most lucrative fraud in accounts payable simply stops working.