A supplier says their bank details have changed

Short answer

Never verify a change using contact details supplied in the message asking for it. Call a number you already held, confirm with a person you have spoken to before, and check the request against the account you have paid previously. Many businesses also fall outside the reimbursement rules they assume protect them.

The rule that matters most

A document announcing a change can never be the evidence that the change is legitimate. The invoice is the attack instrument. Accepting it as its own corroboration turns the weapon into the control that clears it.

This sounds obvious written down, and it is broken constantly, because the alternative takes ten minutes and the invoice is already open.

What to actually do, in order

1. Stop the payment. Before anything else. Money that has not left can be held with a phone call; money that has left is a recovery process with a poor success rate.
2. Call the supplier on a number you already had. Not the number on the new invoice, not the number in the email signature, not a number from the website you reached via a link in the email. A number you held before this message arrived.
3. Speak to a named person you have dealt with. Not a generic accounts line reached through the same compromised channel.
4. Verify the change itself, not the invoice. Ask them to confirm the sort code and account number back to you. Do not read them out for confirmation.
5. Record who checked, when, how, and against what. A verification with no author and no timestamp is not a control, it is a memory.
6. Use Confirmation of Payee, but understand what it answers. It tells you whether the name you typed matches the name on the account. It does not tell you whether that account should be receiving your money. A similar name returns a close match with the real account name for you to check, and an attacker who has registered a company in the same name can produce a full match. It does not cover Bacs.

The part most businesses get wrong about reimbursement

The UK’s mandatory reimbursement regime for authorised push payment scams came into force on 7 October 2024. It applies to Faster Payments and CHAPS, splits the cost between the sending and receiving payment service providers, has a maximum mandatory reimbursement of £85,000, and allows a claim excess of up to £100 at the provider’s discretion.

It covers consumers, micro-enterprises and charities. A property management company, an agency or a contractor above the micro-enterprise threshold is outside it. Many business owners assume a safety net that does not extend to them, and find out at the worst possible moment. Check where your business sits before you need to know.

Build the check into the payment, not the policy

Every business already has a policy about this. Policies are read once. The check that works is the one that happens at the moment of payment, to the person about to authorise it, with the previous account details on the screen next to the new ones.

That is where Tervra puts it: a changed destination holds the payment before authorisation, the previous details are shown, and it cannot be cleared by confirming a dialog. You state that you checked with the supplier on details you already had. How money out works.