How to Confirm Supplier Bank Details Before You Send Payment

How to Confirm Supplier Bank Details Before You Send Payment

Why Bank Detail Fraud Has Become the Default Attack

Payment diversion used to be rare because it required physical access to paperwork. Today it requires one compromised email account.

A criminal who gains access to a supplier's inbox simply waits for a live order, then sends a message that looks exactly like the supplier's normal correspondence. The message explains that the company has changed banks, that the old account is closed, or that a new account should be used for this payment only. If the buyer pays without checking, the money leaves the buyer's country and lands in an account the criminal controls. By the time anyone notices, the funds have usually been moved again.

The pattern is consistent across markets. A study of payment diversion cases by the FBI found that small and mid sized businesses, importers, and property buyers are the most frequent targets because they send large, time sensitive payments to suppliers they rarely meet in person. Losses are counted in billions each year, and recovery is the exception rather than the rule.

That is why verification is not a paperwork formality. It is the single control that stops the most expensive mistake in international trade.

The Three Channels a Criminal Can Break

To verify properly, you need to understand which communication channels can be forged.

• Email. Easy to spoof or compromise. A forged sender name and a reply to address that looks similar are often enough. Email alone should never authorise a bank change.
• Instant messaging. Supplier relationships often move to messaging apps. A stolen or cloned account can send new bank details that look completely normal in tone.
• Documents and invoices. A genuine invoice can be edited and resent, or a fake invoice can be produced with the supplier's own letterhead and tax number. A correct looking invoice proves nothing about the account on it.

The only channel that reliably resists attack is a live voice or video call to a number you already had on file, ideally with someone you have spoken to before. If you have to use a new number, verify it through the supplier's registered website domain, not through a link in a message.

A Simple Five Step Verification Routine

This routine takes under ten minutes and can be repeated for every supplier.

1. Keep a master supplier record. Store the bank details you first verified, along with the date, the person who confirmed them, and the method used. This becomes your source of truth.
2. Run a callback for every change. If bank details change, call the supplier on a number already in your record. Never call a number supplied in the change request itself.
3. Read the details back. Ask the supplier to read out the bank name, account number, IBAN or local routing code, and the exact account holder name. Compare them character by character with the invoice.
4. Check the account holder name. This is where most diverted payments fail to pass. If the invoice is issued by a trading company but the account name belongs to a random individual in another country, stop and question it.
5. Record the approval. Note who verified, when, and how. If a dispute arises later, this log shows your process was sound.

Why the Account Holder Name Matters More Than the Number

A single wrong digit in an account number usually causes a failed or returned payment, which is frustrating but recoverable. A mismatched account holder name is far more dangerous, because the payment can succeed and the money can be gone.

Three mismatches should always trigger a pause:

• Company name versus personal name. Suppliers sometimes legitimately invoice through a director's personal account, but this is rare and should be documented in a signed contract.
• Supplier country versus bank country. A supplier registered in one jurisdiction with an account in an unrelated third country deserves a direct question.
• Trading name versus registered name. A brand name on the invoice is not a legal entity. Ask for the registered name and check it matches the bank record.

If the names do not line up and the explanation is vague, delay the payment. A short delay costs less than a lost transfer.

Where Speed and Limits Decide Whether Verification Works

Here is the practical tension. Verification asks you to slow down and confirm, while trade asks you to pay quickly so goods move.

Old fashioned banking makes that tension worse. A wire sent through correspondent banks can sit in screening for a day or more, and once it is released, reversing it depends on the receiving bank's cooperation, which you cannot control. Some banks also cap how much you can send in a single instruction, which forces a large payment to be split into several transfers. Each additional transfer is another chance for details to be mistyped and another set of fees.

This is the part of the workflow that DapsyPay was built for. The platform runs on conventional transfer rails such as SEPA and ACH, so payments move fast without a long correspondent chain, and there are no limits that force a large supplier payment to be broken into smaller, riskier pieces. You confirm the details once, send the full amount in one instruction, and delivery goes straight into the supplier bank account you verified. Transparent fees and a visible exchange rate mean the amount that leaves is the amount you agreed, with no hidden deductions arriving at the other end.

For teams managing many suppliers, this matters because the verification routine above only works if the payment itself is predictable. When a transfer behaves the way you expect, you can standardise the check and stop treating every payment as a special case.

Building Verification Into Your Payment Process

A one off check protects one payment. A process protects the business.

• Separate the people who approve from the people who pay. A second pair of eyes catches details that the person closest to the order will gloss over.
• Set a rule that bank changes always require a callback, no matter how urgent the order is. Urgency is the attacker's main tool.
• Flag first time suppliers. New relationships deserve extra checks, because there is no history to compare against.
• Reconfirm annually. Run a routine check on long standing suppliers once a year rather than assuming nothing has changed.
• Keep contracts current. A signed agreement that lists the payment account and the process for changing it removes ambiguity later.

Businesses that pay overseas regularly should also read our explainer on what payment infrastructure providers actually do and our article on how FX agents keep large settlements funded, both of which explain why the rails you choose change how much control you keep over each payment.

Common Mistakes That Lead to Lost Payments

• Trusting an email that announces a bank change, even when the email looks perfect.
• Calling the number printed on the new invoice instead of the number already on file.
• Accepting an account holder name that has nothing to do with the supplier.
• Splitting a large payment into small transfers to dodge a bank limit, which multiplies the number of chances for error.
• Failing to keep a record of who verified the details and when.
• Assuming a long standing supplier cannot be impersonated. Compromised inboxes belong to real suppliers.

Frequently Asked Questions

Conclusion

Confirming supplier bank details is one of the cheapest and most effective controls in international trade. Call on a known number, read the details back, check that the account holder name matches the supplier, and record who approved the change. Do that every time, and the most common and most expensive form of supplier fraud loses its easiest path into your business.

For the payment side of the process, DapsyPay keeps transfers fast and predictable on conventional rails, with no limits on how much you can send in one instruction and delivery straight into the verified supplier account.

For related reading, see our guide on how long a Trade Assurance refund takes. If your team also handles digital assets, our separate article covers sending value across networks safely.