How to Verify a Subcontractor Bank Account Change
Reviewed by Adam Pittman, founder and president of Computerbilities.
Before changing a subcontractor’s payment details, call an authorized contact using a previously verified number, check the actual payment instructions through your approved process, and have a second authorized person review the change. Keep a record of those checks before updating the vendor record or releasing payment.
Consider a fictional request: an email arrives in a familiar subcontractor thread just before a payment run. It references the right project and says the subcontractor has changed banks. A project manager forwards it to accounting because a deposit is due.
The project reference helps identify the transaction, but it does not establish who authorized the new banking information. The FBI’s business email compromise guidance explains how criminals can impersonate trusted senders or gain access to billing conversations, and advises independently checking changes to account information or payment procedures.
1. Hold the requested change for verification
Keep the new instructions out of the approved vendor record until verification is complete. Tell the finance lead and project manager that the payment details are being checked, so they can address any schedule implications with the subcontractor through a trusted channel.
Record when the request arrived and which invoice or project it concerns. Preserve the original message using your company’s approved process.
An urgent payment deadline should use the same verification route as a routine request. Agree on an escalation contact in advance for requests that arrive when the usual approver is on a jobsite or away from the office.
2. Find a contact route you already trust
Use a previously verified phone number from the approved vendor record or onboarding documentation. Do not substitute a new number, link, or QR code supplied in the message asking for the change.
Place the outbound call yourself. An incoming call appearing to confirm the request should not replace the callback. If your established contact has also changed, complete your vendor re-verification process before accepting the replacement details.
The FBI recommends confirming payment requests through previously known phone numbers and using a second review for changes affecting vendor payments.
3. Confirm both the authority and the instructions
Reach someone authorized to confirm banking changes for the subcontractor. Use a consistent opening so the employee making the call knows what to establish.
Suggested callback wording:
We received a request to change payment information for [project or invoice]. We verify these requests using the contact details already on file. Did your company authorize this change, who approved it, and when should it take effect?
This wording is a starting point for a company procedure, not proof by itself that the change is legitimate. Your accounting team should also compare the recipient and banking details through its approved secure process. A general “yes, we changed banks” is not enough to establish which instructions should be used.
If the subcontractor disputes the request, the answers conflict, or the authorized contact cannot be reached, keep the change on hold and escalate it. Follow the established process for resolving a disputed request. A small test payment alone does not establish that an account belongs to the intended subcontractor.
4. Give verification and approval clear owners
Have a second authorized person review the verification evidence and proposed payment details before the change takes effect. Decide who can edit the vendor record, who can approve a change, and who can release payment. Separate those duties where practical for your team.
The project manager may confirm that an invoice relates to approved work. That does not automatically make the project manager the person authorized to approve new banking instructions. Document both responsibilities so a forwarded email is not mistaken for payment authorization.
Name a backup approver. A small office needs a workable escalation route when its usual reviewer is unavailable, rather than an improvised exception at the payment deadline.
5. Keep a verification record someone else can follow
Use a consistent record that answers these questions:
- Which subcontractor, project, and invoice does this affect?
- When was the request received, and where is the original message retained?
- Which trusted record supplied the callback number?
- Who was reached, and what authority did that person have?
- When and how were the proposed instructions checked?
- Who completed the second review, and what was the decision?
- Who updated the vendor record, and when?
Store full banking details in the restricted accounting system. A worksheet can reference that record without circulating the account details to everyone involved in the project.
Keep the payment-release record distinct from the verification record. That makes it possible to establish whether the request was checked, approved, entered, and actually used for a payment.
Download a vendor bank-change request template
Our free invoice-fraud kit now includes a fillable vendor request, a separate internal verification record, and secure-signing instructions. The vendor signs the request through your configured signing process; your team records its callback, evidence and second review separately.
A signature alone does not authorize a bank-account change or payment. Confirm the signer’s authority and the exact banking instructions through your approved process. Keep the signed request unchanged and store completed records in your restricted finance system.
Practice the handoff before the next payment run
Use a fictional request with your project manager, accounts payable employee, and approver. Ask each person to show where the trusted contact number comes from, who performs the callback, and where the review is recorded. Use made-up account information and send no money.
Then make the usual approver unavailable in the exercise. Can the team identify the backup reviewer without skipping a required check? Fix any missing contact or unclear responsibility before using the procedure with a real request.
If a suspicious payment has already been sent
Contact your financial institution immediately through its trusted fraud channel and ask what action is available for that transaction. Alert your finance and IT leads and preserve the original communications and transaction references. The FBI advises contacting the financial institution immediately and reporting business email compromise to the Internet Crime Complaint Center. Recovery is not guaranteed.
Give your team a repeatable payment check
Download Before You Pay: Construction Invoice-Fraud Prevention Kit. The nine-page kit includes a payment checklist, callback script and verification record, suggested team procedure, a response card with a practice scenario, and the vendor request template with secure-signing instructions. Adapt it with your finance and IT leads before adopting it as company policy.
For controls beyond a single bank-change request, read our construction vendor payment and wire-fraud prevention guide.
Computerbilities helps construction businesses with 10–250 technology users across Raleigh, Cary, Durham, and the NC Triangle. To discuss email security and the technology supporting your payment process, book a free 15-minute IT risk call or call 919-469-5060.