Answers · bookkeeping
A vendor emailed new bank details and asked us to pay the next invoice there. How do I check it's real before paying?
Last updated
TL;DR: Treat every bank-detail change as unverified until you've confirmed it by phone with someone you already know at the vendor, using a number from your own records, not one in the request. This is the most common setup for business email compromise: a real or spoofed vendor email says the bank account changed, and the next payment goes to the fraudster. The FBI's IC3 recorded 24,768 business email compromise complaints in 2025 with reported losses of $3,046,598,558, and wire transfer or ACH was the payment type in 86% of them. The FBI's advice is to verify all payment changes in person or via a known telephone number. Make the change a two-person job: one person takes the request and calls back, a different person (or the owner) approves the change, and the first payment to the new account is small, checked or confirmed with the vendor. Watch the edit itself too. Xero users report its bank-detail change email goes only to the person who made the change, so the owner needs another way to see every change. If money already went out, call your bank right away to ask for a recall, and file at ic3.gov. Not legal or banking advice.
What should I check, step by step?
1. Don't change anything from the email, PDF or call that asked for it. Treat urgency, a new country or bank, a slightly different sender domain, or a refusal to talk by phone as warning signs, as the FBI's field offices list them.
- Call the vendor on a number you already had before the request: an old invoice, the contract, or your vendor file. Ask for someone you've dealt with and have them read the new details to you rather than confirming yours.
- Write down who asked, how, the number you called and where it came from, who confirmed, and when.
- Have a different person approve the change than the one who took the request. In a small business that's the owner. Restrict who can edit vendor bank details: Xero has a separate permission for it, and in QuickBooks Online every vendor edit shows in the audit log.
- Hold the first payment to a changed account, or send a small one first and confirm with the vendor that it arrived before releasing the full amount.
- Before every payment run, list vendors whose bank details changed since the last run and check each change has a recorded callback and approval.
- If an AI agent reads the accounts payable inbox, don't let it change vendor bank details or release payments to new details. It can flag the request; a person makes the call.
- If a payment already went to a fraudulent account, the IC3 says time is of the essence: contact your bank immediately to request a recall, and file a complaint at ic3.gov with the full transaction details.
How common is vendor bank account change fraud (business email compromise)?
The IC3 describes business email compromise as a scam targeting businesses working with suppliers and those that regularly make wire transfers, carried out by compromising email accounts and other channels such as phone numbers and virtual meetings. In 2025 it took 24,768 complaints and $3,046,598,558 in reported losses, second only to investment fraud, and wire transfer or ACH was the reported payment type in 86% of BEC complaints. The IC3 also says businesses reported over $30 million in losses to BEC scams involving AI in 2025.
- A changed bank account is the simplest version: the invoice and vendor are real, only the destination is new. Because the email can come from the vendor's real account after it's been compromised, checking the sender address isn't enough.
- Nacha's ACH rules now name this directly. Since June 22, 2026 (March 20, 2026 for the largest originators), every business that originates ACH payments must have risk-based processes to identify ACH entries initiated due to fraud, including payments induced under False Pretenses, which Nacha says covers business email compromise and vendor impersonation, and review them at least annually.
Do QuickBooks or Xero alert you when a vendor's bank details change?
QuickBooks Online's audit log records edits to vendors, can't be turned off and keeps events for two years. Changes made by a connected third-party app show as System Administration, not a person, so an app or agent editing vendors is easy to miss unless you look for it.
- Xero users report on Xero's own ideas forum that the bank account change notification goes only to the user who made the change. On September 29, 2026, Xero replied that letting businesses choose who gets it isn't directly on the roadmap yet. Until then, a second person has to review changes some other way.
- Neither alert tells you whether the vendor actually asked. The callback to a known contact is the step that stops the fraud.
How do I record a vendor bank change callback and approval?
Keep the evidence somewhere the person who made the change can't edit. Rightshold's request_human_approval hashes the exact change (your vendor reference, a hash of the new bank details, and a hash of your callback notes) and only the owner's account key can decide it. The signed, timestamped decision goes on Rightshold's ledger.
- Before each payment to a changed account, send the signed decision receipt with the bank details as they stand in the payment batch to verify_human_approval (free). It hashes what you send and compares it with the approved hash, so if someone edits the details again after approval, the action doesn't match and the payment should stop. Looking an approval up by its id only returns its status and receipts; it doesn't compare the bank details.
How do I ask Rightshold about this (free, no key)?
Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code, then ask: “Before this payment goes out, check the approval for vendor V-0142's bank change and confirm the bank details in the payment batch match what I approved.”
{
"tool": "verify_human_approval",
"arguments": {
"receipt": "<decision receipt exactly as returned by decide_human_approval>",
"signature": "<its signature>",
"action": {
"type": "vendor_bank_change",
"vendor_ref": "V-0142",
"new_bank_details_sha256": "<sha256 of routing and account number in the payment batch>",
"callback_notes_sha256": "<sha256 of your callback record>"
}
}
}- Free, no key. Send the decision receipt and signature, plus the action as it stands in the payment batch. A different account number gives a different hash, so the action doesn't match and the result isn't valid. Sending only the approval id ({id}) returns the approval's status and receipts without comparing the action, so use the receipt form for this check. If you only kept the id, look it up first and use the decision receipt and signature it returns.
- Create the approval first with request_human_approval (API key) using the same action object and a summary without personal data. Only the owner's account key can decide it (decide_human_approval); delegated agent keys are refused.
- Send hashes, not account numbers. Hash the routing and account number exactly as your payment file stores them so the check is repeatable.
- revoke_agent cuts off an agent's key if it's been compromised or has been editing vendor details it shouldn't.
Rightshold doesn't connect to your bank, email or accounting software, and it doesn't verify vendors, detect business email compromise or stop payments. It records the approvals you send and lets anyone check them later. It only protects you if your payment process refuses to pay changed bank details without a matching approval. Not legal, banking or accounting advice.
What are the sources?
- FBI IC3: 2025 Internet Crime Report (BEC complaints and losses, transaction types, Recovery Asset Team guidance)
- FBI IC3 PSA: Cyber criminals conduct business email compromise through exploitation of cloud-based email services (verify payment changes via a known telephone number)
- FBI Sacramento: Guard against and report business email compromise (warning signs)
- Nacha: Risk Management Topics, Fraud Monitoring Phase 2 (effective June 19, 2026, practical date June 22; False Pretenses)
- QuickBooks Online: Use the audit log (vendor edits recorded, can't be turned off, two years, third-party app changes show as System Administration)
- Xero Product Ideas: Set which users receive the bank account change notification (Xero response, Sep 29, 2026)
- Bonerath: Adding your accountant as an adviser user in Xero (the Bank account admin permission controls who can add or edit contacts' bank details)
Related
- How to spot a fake vendor in your accounts payable
- How to enforce segregation of duties so an AI agent can't both create and approve a payment
- Showing a human the actual change before approving an AI agent action
- How to keep a copy of your business books that your bookkeeper can't edit
Not legal advice. JSON · Markdown · All answers
Get a free API key in one call
No card and no email needed. 100 free credits; the license and policy checks stay free without a key.
curl -s -X POST https://www.rightshold.com/v1/accounts/signup -H "Content-Type: application/json" -d '{"accept_terms":true}'
export RIGHTSHOLD_API_KEY=rs_... # the api_key from the reply (shown once)
curl -s https://www.rightshold.com/v1/licenses/check -H "Authorization: Bearer $RIGHTSHOLD_API_KEY" \
-H "Content-Type: application/json" -d '{"license":"MIT","intended_use":{"commercial_use":true}}'