Agency finance safety workshop / 5 MIN READ
Verify the change before finance changes the destination
Route supplier bank-detail changes through independent verification and authorized finance review.
AI-assisted research and analysis for the SNS Creative Fieldbook
Sources checked 2026-11-06
A familiar-looking message can contain an unfamiliar payment destination. Treat a request to change supplier banking details as a separate controlled action, with independently verified contact and finance approval before any record or payment instruction changes.
What you will leave with: A bank-detail change verification record for the authorized finance team.
Use this when
- A supplier sends new bank details or changes payment instructions.
- A project manager is asked to pass an urgent account change into finance.
This is not a payment instruction, authority to alter supplier records or a request to collect banking passwords, security codes or authentication credentials.
Recognize the change as a verification event
The FBI advises checking changed payment details through independently obtained contact information. A familiar sender name, invoice layout or existing email thread is insufficient by itself.
Identify exactly what is being changed and pass the request through the organization’s approved finance process. Keep the proposed change separate from already verified supplier information. Do not edit a working payment list merely to help colleagues meet an urgent deadline. If the request includes unfamiliar links or attachments, follow the approved security handling route rather than using them to establish that the message is genuine.
Use a contact route independent of the request
Have the authorized verifier contact the supplier through a previously validated or independently established route. Do not use a new phone number, contact name or verification link supplied only in the change request as the independent check.
Confirm that the person reached is authorized to discuss the supplier’s payment arrangements and follow finance’s required verification procedure. A caller’s confident familiarity with the project does not replace identity checks. If the trusted contact is unavailable or gives an inconsistent answer, keep the change pending and escalate. Do not resolve uncertainty by asking the same unverified email sender to reassure you again.
Keep verification separate from approval and payment
Record the verification outcome in the approved location and send it to the finance owner who can assess and authorize a change. Share only necessary information through permitted channels; avoid copying full account details into a broad project chat or teaching exercise.
Follow the organization’s separation of duties and any required additional review. A verified supplier request can still need contractual or administrative checks before it is applied. Confirm which entity and future transactions the change would affect. Never ask for a password, one-time authentication code or remote account access to complete this operational check, and never send a test payment as an informal substitute for approval.
Close the change or escalate the uncertainty
Have finance confirm the final status: rejected, pending, approved but not applied, or applied through the authorized process. Make that status visible to the people who could otherwise act on the original request. Preserve relevant evidence according to the incident and finance procedures.
If a payment may already have gone to the wrong destination, alert finance and the security or fraud response owner immediately so they can contact the financial institution and appropriate authorities. Do not wait to finish a neat report or promise recovery. Keep external explanations with authorized owners and avoid accusing a supplier or employee before the facts are established.
Make the reasoning concrete.
A fictional production supplier emails an agency a replacement bank account shortly before an invoice is due. The message includes a new mobile number and says the usual finance contact is unavailable.
Verify through the supplied number
Opening: Call the new number and update the payment spreadsheet after reassurance.
Hypothesis: The request seems to have received a second check.
Risk: Both the message and the verification route could belong to an impostor.
Use the established finance route
Opening: Keep the change pending while the authorized verifier uses independently validated supplier contact details.
Hypothesis: The check is independent of the suspicious instruction.
Risk: The payment timetable may need finance-led handling while verification remains unresolved.
The project manager does not alter records or initiate a transfer. Finance receives the request, verification status and relevant evidence, then decides the next action under its established controls.
Take the questions into your next brief.
Use these prompts in your own notes. Nothing is submitted from this page.
Change
What payment detail or procedure is being altered?
Independent contact
Which validated route was used to reach an authorized supplier representative?
Verification
What was confirmed, and what remains uncertain?
Approval
Who in finance can authorize and apply the change?
Status
What prevents anyone acting on an unverified destination?
Watch for the wrong conclusion.
- Calling a number supplied only in the change request.
- Treating urgency as a reason to bypass finance review.
- Making a test payment or collecting credentials as a shortcut.
Your next action
Check your team’s bank-change handoff process and ensure it names an independent verification route and an authorized finance owner.
Sources & scope
The workflow, worksheets and hypothetical examples are original editorial analysis. Sources support only the identified principles. No measured business results or named human reviewer are claimed.
- FBI: Business Email Compromise →Primary law-enforcement prevention guidance · Supports: The FBI advises independent contact verification for changed payment details; the finance handoff and status record are original editorial analysis.