Payment Change Verification Procedure

Purpose

This procedure defines how the company verifies requests to create or change payment instructions, supplier bank details, employee payment details, or other financial destination information.

The objective is to prevent attackers from redirecting legitimate payments by compromising email accounts, impersonating vendors or employees, or manipulating normal business processes.

Scope

This procedure should apply to changes involving:

• Supplier bank account details
• Customer refund details
• Employee payroll bank details
• Contractor payment details
• Payment processor accounts
• Standing payment instructions
• Direct debit information
• International payment destinations
• Other financial destination information

Core Requirement

A payment destination must not be changed based only on an email, message, attachment, or electronic form requesting the change.

Important changes should be independently verified using contact information already known to the company.

Step 1: Treat the Change as a Fraud Risk

Requests to change bank or payment details should receive additional verification even when:

• The email appears legitimate
• The request comes from an existing contact
• Previous email correspondence is included
• The request contains company branding
• The sender knows details about previous invoices
• The message appears within an existing email conversation

Compromised email accounts can make fraudulent requests appear authentic.

Step 2: Check the Request

Review the request for unusual indicators such as:

• New bank account
• Different country
• Different beneficiary name
• Urgent request
• Unusual explanation
• Request to bypass normal procedure
• New email address or domain
• Slightly altered domain name
• Sudden change in communication style
• Instructions not to contact the normal representative

These indicators increase concern but are not required before verification is performed.

Step 3: Independently Verify the Change

Verify the request using a trusted contact method that was established before the change request.

Suitable methods may include:

• Calling a previously known telephone number
• Contacting a known representative through established contact details
• Using an authenticated supplier or payroll portal
• Verifying through another approved internal or external contact

Do not use a telephone number supplied only within the change request itself unless independently verified.

Step 4: Verify Specific Information

During verification, confirm:

• Organization or individual requesting the change
• Bank or payment destination
• Account holder or beneficiary name
• Effective date
• Reason for change where appropriate
• Person authorized to request the change

The verifier should not simply ask:

“Did you request a bank change?”

Where practical, require the other party to independently confirm important details.

Step 5: Require Appropriate Approval

Payment detail changes should be approved by an authorized employee.

Higher-risk changes may require a second person.

Approval should be separate from the person requesting or entering the change where practical.

Step 6: Record the Verification

Record:

Request date: ____________________

Supplier / employee / recipient: ____________________

Requested change: ____________________

Request received from: ____________________

Verified by: ____________________

Verification method: ____________________

Trusted contact used: ____________________

Date/time verified: ____________________

Approver: ____________________

Effective date: ____________________

Evidence or reference: ____________________

Step 7: Update the System

Only after verification and approval should the payment information be changed.

The person updating the system should confirm:

• Verification was completed

• Required approval exists

• Details entered match the verified information

• Old details were changed intentionally

• Audit or supporting records were retained

Step 8: Consider Additional Verification for Significant Changes

For unusual or high-value situations, consider:

• Secondary approval
• Temporary payment hold
• Confirmation from a second known contact
• Verification through a different communication channel
• Small test payment where appropriate
• Additional bank or beneficiary verification

Suspicious Requests

Stop the process and escalate if:

• Verification fails
• The known contact denies making the request
• The requester pressures employees to bypass verification
• Bank details unexpectedly change again
• Contact information has also changed
• The email account appears compromised
• Something about the request remains unexplained

Do not tell a suspected attacker how the company’s verification controls work.

Payroll Changes

Employee payroll changes should also be independently verified.

Do not rely only on an email requesting that salary be redirected to a new account.

Use an approved HR or payroll process with appropriate identity verification.

Exceptions

Exceptions should be rare.

If normal verification genuinely cannot be completed, the payment or change should be escalated to an appropriate finance or leadership authority before proceeding.

Practical Rule

Never trust a payment destination change simply because the message requesting it looks genuine.

Verify the change through a trusted channel established independently of the request.