Supplier bank details: how to prevent fraud and payment errors

The weak spot: changing the IBAN

Of all the data held on a supplier, bank details change the least often and do the most damage when they are wrong. A transfer sent to the wrong account is hard to recover, and the mistake often comes to light only when the supplier chases a payment that has already been made.

The most insidious case is not a typo but a fraudulent request. An email that seems to come from the supplier, perhaps from an address almost identical to the real one, announces a new IBAN in a polite tone with a hint of urgency. If the master data is updated without checks, the next payment ends up in the wrong hands.

An IBAN change request received by email remains unverified until it is confirmed through another channel.

Verify at the source

The most effective rule is also the simplest: every change to bank details must be confirmed through a different channel from the one the request came in on. If it arrived by email, call the supplier on a number already held in your records, not the one given in the message.

Back this up with documentary evidence, such as a letter from the bank or a statement showing the account holder. The account holder must match the supplier’s company name: if it does not, you need a written explanation and explicit approval.

These checks take a few minutes, and they should be mandatory, with no exceptions for long-standing suppliers or urgent requests.

1. 01 Request received
2. 02 Call to a known contact
3. 03 Bank document
4. 04 Account holder check
5. 05 Approval by a second user

Separate who edits from who approves

No one should be able to change a supplier’s bank details on their own and then authorize the payment. The four-eyes principle, where one person enters the change and another approves it, sharply reduces both errors and the risk of internal abuse.

In the same way, bank details should not be visible to everyone who looks at the master data. Logistics staff need contacts and sites, not the IBAN. Well-defined roles and permissions limit how widely the information is exposed and make it clearer who is responsible for what.

In smaller organizations this can feel like excessive formality, since there are few people and everyone knows each other. There, it is enough for the approval to come from someone other than the person who received the request, even if that is the owner: the value of the check lies in the second pair of eyes, not in the size of the organization.

A single user

• Edits and approves alone
• Bank details visible to all
• No cross-check

Four eyes

• Whoever enters does not approve
• Access for authorized roles only
• Every change has two sign-offs

Traceability and warning signs

Every change to bank details must leave a trail: who requested it, who verified it, with which document, who approved it and when. The history is not only useful in a dispute; it also helps spot suspicious patterns, such as several changes in quick succession for the same supplier. Reviewing it periodically, even by sampling, shows whether the rules are really being applied.

It is worth sharing a few recurring warning signs with the team: unusual urgency, an account in a different country from the supplier’s registered office, an account holder that does not match, an email address slightly different from usual, a request arriving just before a large payment. None of these proves fraud, but each one justifies an extra check.

Warning signs

• Unusual urgency
• Account in another country
• Different account holder
• Similar but not identical email
• Request close to a payment

Checks built into the process

Rules only really work when they are part of the tool people use every day. If verification relies on a procedure written up in a separate document, sooner or later someone will skip it in a hurry. The best way to prevent that is for the system not to allow an unverified change to be saved.

In the Innovaq CRM, bank details have a dedicated tab within the registration file, visible only to authorized roles. Automatic checks validate the IBAN format and the match with the account holder, AI flags inconsistencies before anything is saved, and every change is tracked in the record. When the supplier submits new details through their own completion link, the change still enters the verification and approval flow.