Vendor Bank Change Requests: How to Stop Payment Fraud
An AP playbook for vendor bank change fraud: what Nacha's 2026 rules and the FBI say, a call-back procedure with dual approval, and what to do if you paid.
Treat every request to change a vendor's bank account as unverified until someone on your team has called the vendor on a phone number you already had on file, and a second person has approved the change. Nacha's 2026 fraud-monitoring rules call for risk-based processes to identify fraudulent ACH entries, and Nacha says its "False Pretenses" definition covers vendor impersonation and business email compromise. The FBI advises verifying account changes on a second channel.
General information, not tax or legal advice.
The short answer
A bank change request is a payment instruction, not a paperwork update. We recommend verifying it on a channel you already trust, requiring a second approver, and logging both. For the wider picture of handling vendor documents safely, start with our secure W-9 collection guide.
Why this matters in a real workflow
The FBI's IC3 describes business email compromise (BEC) as a scam targeting businesses that work with suppliers or regularly make wire transfers. Fraudsters compromise email, phone or virtual-meeting accounts to redirect funds (FBI IC3, 2025 Internet Crime Report).
The FBI's Internet Crime Complaint Center logged 24,768 business email compromise complaints in 2025, with more than $3 billion in reported losses (FBI IC3, 2025 Internet Crime Report). These are reported complaints, not every incident.
In AP, the redirect usually looks routine: a "vendor" says they've changed banks and asks you to update their details before the next payment run.
What Nacha, the FBI and the FTC say
The guidance that bears most directly on vendor bank changes comes from Nacha's ACH rules and from the FBI and FTC, not from the IRS.
Nacha's 2026 fraud-monitoring rules
Nacha's new fraud-monitoring rules took effect March 20, 2026 for all ODFIs (originating banks), for non-consumer originators and third parties that originated 6 million or more ACH entries in 2023, and for RDFIs (receiving banks) that received 10 million or more (Nacha: Fraud monitoring, Phase 1).
Phase 2 took effect June 19, 2026, with a practical date of Monday, June 22. It extends the fraud-monitoring requirement to all remaining non-consumer originators, third-party service providers and third-party senders (Nacha: Fraud monitoring, Phase 2). Phase 2 also covers all remaining receiving banks and requires the processes to be reviewed at least annually.
Two points matter most for AP teams:
- Vendor impersonation is named. Nacha defines "False Pretenses" as inducing a payment by misrepresenting identity, authority or account ownership. It says this covers business email compromise and vendor impersonation, but not scams over poor-quality goods.
- It's risk-based. Nacha's rules don't require screening every ACH entry individually or monitoring before processing. They require a risk-based approach.
Nacha also says ACH credit entries, such as vendor payments, should be properly authorized, and that written authorization is often industry best practice (Nacha: The importance of compliant ACH authorizations). Ask your bank how these rules apply to your business. In our view, a documented bank-change procedure is a practical risk-based control.
FBI and FTC verification guidance
- The FBI's IC3 advises using secondary channels or two-factor authentication to verify requests to change account information (FBI IC3 PSA on BEC).
- The FTC advises verifying any email that requests sensitive information through a separate channel, and not using the links, phone numbers or websites in the email (FTC: Protecting Personal Information).
- The FBI advises watching for hyperlinks that misspell the real domain name.
- The IRS warns that scammers who hack an email account can find genuine past messages to a tax professional and use them to make a new request look legitimate (IRS Dirty Dozen 2026). In our view, the same tactic works on an AP inbox.
Recommended workflow: bank change verification
This procedure is our recommendation, not a Nacha or IRS requirement. Adapt the owners to your team; in a very small office, the controller or owner can be the second approver.
Vendor bank change: seven steps
1. Log the request (AP clerk)
Record the date, channel and sender address. Don’t change the vendor record or reply to the sender.
2. Get the new details in writing (AP clerk)
Ask for a signed ACH form or bank letter, returned through a secure channel rather than as an email attachment.
3. Call back on a number you already had (AP clerk)
Use the number in your vendor file, contract or an earlier invoice, never the number in the request or on the new letterhead.
4. Confirm specifics on the call (AP clerk)
Have the contact you know confirm the request and the new account details. Note who you spoke to and when.
5. Second approval (AP manager or controller)
A second person, not the one who took the call, approves the change before it goes live.
6. Watch the first payment (AP manager)
Ask the vendor to confirm receipt of the first payment to the new account.
7. Keep the record (AP manager)
Store the request, authorization, call notes and approvals with the vendor file.
Exception path: if you can't reach the vendor on a known number, the change doesn't happen. Pay the existing account or hold the payment; never switch accounts to meet a deadline.
If the vendor's name or TIN changes too, handle it separately: the W-9 says a payee must furnish a new W-9 if the name or TIN changes for the account (Form W-9, Rev. March 2024). Collect it, but still verify the bank change.
Dual approval, in practice
The point is that no single person can move money to a new account. We recommend that the person who takes the call never approves the change, and that whoever edits the vendor record can't also release the next payment run alone.
Red flags
Our list. Any one of these is a reason to stop and verify.
- A bank change arrives by email with no prior conversation.
- A link or sender address misspells the vendor's real domain.
- The reply-to address differs from the sender.
- It arrives as a reply in a real, older thread.
- It pushes urgency: "update before Friday's run or we'll put your account on hold."
- The new account is in a different name than the vendor, or at a bank in a different region, with no explanation.
- A new W-9 arrives with the bank change, as if one proves the other.
Example scenario
Example scenario: Harbor Lane Dental Group, a made-up practice, gets a reply on last month's invoice thread from its lab supplier's billing contact, asking for future ACH payments to go to a new account. The AP clerk logs it and calls the supplier on the number in the vendor file. The owner says they haven't changed banks. The AP manager keeps the original account in place, and the supplier checks its own mailbox for compromise.
If you already paid
If money has already gone to an account you now suspect, the FBI says time is of the essence (FBI IC3, 2025 Internet Crime Report). Our recommendations:
- Call your bank immediately (controller or owner). Ask for its fraud team and have the payment date, amount and receiving account ready.
- Tell the real vendor (AP manager), using the number on file, so they can check their own systems.
- Preserve the evidence (AP manager). Keep the emails, attachments and your call log.
- Secure your side (IT). Reset passwords and review mailbox rules for any account that handled the request.
- Ask your bank about next steps for reporting, including a complaint with the FBI's IC3.
In 2025, the IC3's Recovery Asset Team froze $679,013,183 of $1,163,919,846 attempted across 3,900 Financial Fraud Kill Chain incidents, covering several fraud types, not only BEC (FBI IC3, 2025 Internet Crime Report).
Common mistakes
- Replying to the suspicious email to ask if it's genuine.
- Skipping verification for "small" vendors or long-standing ones.
Checklist
- Written bank-change procedure, shared with everyone who can edit vendor records
- Call-back uses a number already in the vendor file
- Second approver who didn't take the call
- New bank details received through a secure channel, not an email attachment
- Vendor confirms receipt of the first payment to the new account
- Request, call notes and approvals stored with the vendor file
For the rest of the new-vendor setup, see our vendor onboarding checklist.
How W9Vault supports this workflow
W9Vault can help with step 2: one request can ask for an ACH form, plus a W-9 if the vendor's name or TIN has also changed. The vendor gets a secure upload link that expires after 7 days and uploads PDF, JPG or PNG files up to 20 MB. Files are encrypted in the vendor's browser before upload, so the server never receives the plaintext file, and uploaded files are automatically deleted 30 days after upload for completed requests. Your dashboard shows whether the request is sent or completed.
A secure upload link does not replace calling the vendor back. It keeps the document out of an email inbox, but it can't tell you whether the uploader is really your vendor. W9Vault is designed to support a secure collection workflow; the customer remains responsible for their own tax, recordkeeping and security obligations. For how W-9s, W-8BENs and ACH forms fit together, see our vendor tax documents guide.
Collect ACH forms without email attachments
Send vendors a secure, expiring upload link for their ACH form and W-9, then verify any bank change by calling a number you already have.
Frequently Asked Questions
Phase 2, effective June 19, 2026 with a practical date of June 22, extended fraud monitoring to all remaining non-consumer originators, third-party service providers and third-party senders. Ask your bank how the rules apply to you.
Not on its own, since a form can be forged. We recommend a call-back on a number you already had and a second approver.
Call your bank immediately. The FBI says that if you discover a fraudulent transfer, time is of the essence. Then tell the real vendor using the number on file and keep all the emails and records.
No. A secure link protects the document in transit, but it cannot confirm who uploaded it. Verify every bank change by calling back on a known number.
Official resources
- Nacha: Fraud monitoring, Phase 1
- Nacha: Fraud monitoring, Phase 2
- Nacha: The importance of compliant ACH authorizations
- FBI IC3, 2025 Internet Crime Report (PDF)
- FBI IC3 PSA on business email compromise
- FTC: Protecting Personal Information, A Guide for Business
- IRS Dirty Dozen 2026 (IR-2026-30)
- Form W-9 (PDF), Rev. March 2024
