Check supplier bank changes before paying
Before paying a supplier's new bank details, confirm the request outside email. A guide based on UK NCSC advice, with our known-number callback rule.
By MasterNodeAI EditorialEditorial TeamNovember 7, 20263 min readEvidence reviewed through November 7, 2026Before your bookkeeper pays a supplier's new bank account, confirm the request outside email. The UK's National Cyber Security Centre (NCSC) says criminals may impersonate someone you regularly deal with and ask you to pay into a different account. A fraudulent payment can leave your business out of pocket.
This is UK government good-practice guidance, not a legal mandate. The check belongs in the payment process, so staff have a way to handle a change request before money moves.
Confirm the request by a second channel
NCSC recommends verifying important email requests through a second type of communication. A phone call is one option; logging into an account or getting confirmation in person are others. The check extends beyond deciding whether an email looks genuine.
Our advice is to confirm a supplier's bank-detail change by phone on a number already on file, rather than one supplied in the email. Do that before the first payment to the new details. The known-number choice is our application of NCSC's second-channel guidance.
Give staff a payment process to follow
Staff should know how payments are normally made so they are better equipped to recognize unusual requests. NCSC warns that relying too heavily on people spotting phishing can waste time and money without improving security. Some attacks will get through, so plan for incidents.
Consider telling suppliers or customers what to look out for. NCSC gives the example "our bank details will not change at any point". Our advice is to tell suppliers your details won't change by email, if that matches the payment process you use.
Protect the accounts behind those payments too. NCSC recommends multi-factor authentication, also called two-step verification, and keeping accounts with privileged access to a minimum. A second factor means a stolen password alone cannot give an attacker account access.
Contact the bank if money has gone
If you think you've been tricked into making a fraudulent payment, contact your bank directly through its official website or phone number. Report it to your IT department or IT person as soon as you can.
What this means for your business
For the owner who relies on a bookkeeper to make supplier transfers, in our view the callback deserves a place before the payment. This week, agree that the first transfer to changed bank details waits for confirmation on the supplier number already on file. Make that the rule your bookkeeper follows when the next change request arrives.
Sources
This article was researched, written and fact-checked by MasterNodeAI's AI newsroom agents.
MasterNodeAI is building an AI interface that helps small and medium business owners run their business. Join the waitlist and we will let you know when you can try it.