Paylist logo
All free tools

Free tool · Templates

Bank details change policy generator

Generate a short, practical procedure for handling requests to change a supplier's or employee's bank details. Answer a few questions, then print it, save it as a PDF or download it for Word.

About the business

For accountants preparing this for a client.

Checks
Version and review

Everything happens in your browser. Nothing you type is sent to Paylist or anyone else, and nothing is saved.

Your procedure

[Business name]: bank details change procedure

Version 1.0 · Effective from [date] · Next review [date]

1. Purpose

This procedure sets out how [Business name] handles any request to change the bank details of a supplier or member of staff. Its aim is to stop payments being redirected to fraudsters (known as mandate fraud or invoice redirection fraud) by making sure every change is independently verified before any money is paid to a new account.

2. Scope

It applies to everyone who can set up or change payee details, or who prepares, approves or releases payments. It covers every request to change bank details, however it arrives — email, letter, phone call, invoice, supplier portal or in person — including requests that appear to come from a known contact, a director or a senior colleague. It also covers changes to employees' bank details for payroll (see section 4).

3. How to handle a change request

  1. Do not act on the request straight away. Never change bank details using only the information in the request, and do not reply to the email or call any phone number given in it.
  2. Log the request in the bank details change log: the date, who it claims to be from, how it arrived, and the old and new details.
  3. Call the supplier back on a phone number already held in our records — from the original contract, earlier invoices or the existing supplier record — never one given in the request, its email signature or a link in it. Speak to a contact you already know and ask them to read out the new sort code, account number and account name, rather than reading them out yourself.
  4. When setting up the new details, check the Confirmation of Payee result from our bank. If it is not a full match, stop and investigate before going any further.
  5. The change must be approved by the [approver's role] before it is saved. Two different people must be involved: the person who verifies or enters the change cannot be the person who approves it, and nobody may approve a change they requested.
  6. Do not make the first payment to the new details until at least 1 working day after the change has been verified and approved.
  7. Tell the supplier the change has been made, using their existing contact details rather than those in the request, so a genuine supplier can raise the alarm if they never asked for it.
  8. Keep the evidence in the bank details change log: who made the call, the number used, who they spoke to, the Confirmation of Payee result and who approved the change. Keep these records for at least six years.

4. Staff and payroll changes

  • Employees must request changes to their own bank details through our usual payroll process, not by email alone.
  • Confirm every change with the employee in person or by calling the phone number already held on their personnel record — never a number given in the request.
  • Be especially wary of requests that arrive shortly before a payroll run, or from a personal email address that isn't on file.
  • The change must be approved by the [approver's role] and entered by a different person, and recorded in the same way as supplier changes.

5. Red flags to watch for

  • Urgency or pressure — “pay today or the order is cancelled”.
  • Requests for secrecy, or to skip the normal process “just this once”.
  • An email address or domain that is slightly different from the usual one, or a reply-to address that doesn't match the sender.
  • A new account in a different name from the supplier, or a Confirmation of Payee mismatch.
  • A move to a personal account, an overseas account, or a bank the supplier has no obvious reason to use.
  • A change that arrives just before a large payment, or attached to an invoice with altered details.
  • The usual contact can't be reached on the number in our records, or the caller pushes you to use a new number.
  • A request that appears to come from a director or senior colleague asking for an unusual or urgent payment.

6. If you suspect fraud

  1. Stop. Do not make the change or release any payment.
  2. If money has already been sent, call our bank immediately on the number on the back of the card or on the bank's website (or dial 159). The sooner the bank knows, the better the chance of recovering the money.
  3. Contact the genuine supplier or employee using the details in our records — their email account may have been compromised.
  4. Tell the [approver's role] straight away.
  5. Report it to Action Fraud on 0300 123 2040 or at actionfraud.police.uk (in Scotland, contact Police Scotland on 101).
  6. Keep all the evidence — the emails (don't delete them), letters, invoices and notes of any calls.

7. Review

The [approver's role] reviews this procedure every year, and after any fraud attempt or near miss. Everyone it applies to must read it and confirm they understand it.

Version1.0
Effective from[date]
Next review due[date]
Approved by[approver's role]

Approved and signed:

Name:

Role: [approver's role]

Date:

Why every small business needs a written procedure

Most payment fraud against small businesses doesn't involve hacking the business itself. A fraudster poses as a supplier, or an employee, and asks for future payments to go to a new account. If the request is believed, the next invoice or payroll run goes straight to the criminal. This is known as mandate fraud or invoice redirection fraud, and it relies on someone acting on a request without checking it.

A short written procedure removes the guesswork. When everyone knows that no bank detail change happens without a call-back to a known number, a polished email or an urgent phone call loses its power. It also protects staff: they never have to decide on the spot whether to trust a convincing request, because the procedure decides for them.

What the procedure covers

  • Purpose and scope: what the procedure is for and who it applies to, including requests that seem to come from directors or senior colleagues.
  • Step-by-step handling: log the request, verify it independently, check Confirmation of Payee, get approval, and record the evidence.
  • Optional controls: dual authorisation, extra checks above a value threshold, a small test payment and a hold period before the first payment.
  • Staff and payroll changes, which are targeted in the same way as supplier payments.
  • Red flags to watch for, and exactly what to do if fraud is suspected — including calling your bank immediately and reporting to Action Fraud.
  • Version, effective and review dates, and a space for the approver to sign.

The single most important control: the call-back

If you adopt only one rule, make it this: confirm every change by phoning the supplier on a number you already hold — from the original contract, earlier invoices or your supplier record — never one given in the request. Fraudsters routinely include their own phone number in a fake request, or ask you to call a “new” mobile. Ask the person you speak to to read the new details out to you, rather than reading them out yourself and asking for a yes.

Choosing the optional controls

Dual authorisation means the person who enters or verifies a change is never the person who approves it. Even in a small team, splitting these roles makes it far harder for one rushed or deceived person to redirect a payment. A value threshold lets you apply heavier checks only where the money at stake justifies it. A small test payment confirms the account works, and asking the supplier to confirm the exact amount received makes it a genuine check rather than a formality. A hold period of a day or two before the first full payment gives a genuine supplier time to notice and tell you if they never asked for the change.

For accountants preparing this for clients

Add your firm's name in the “Prepared by” field and the procedure will say it was prepared for the client by you. Walk the client through it, agree the approver and thresholds with them, and diary the review date. A documented, reviewed procedure is also useful evidence of sensible internal controls if a payment is ever disputed.

Keep it short, and keep it used

A one or two page procedure that everyone has read is worth far more than a long policy nobody opens. Share it with everyone who can change payee details or release payments, ask them to confirm they have read it, and review it at least once a year or after any attempt or near miss.

Frequently asked questions

What should a supplier bank details change procedure include?

At minimum: never act on the request alone, verify it by calling the supplier on a number from your existing records, check the Confirmation of Payee result, have the change approved by a named role, and keep a record of who checked what. Red flags and what to do if fraud is suspected should be included too.

How do I verify a supplier's change of bank details?

Call the supplier on a phone number you already hold — from the contract, previous invoices or your supplier record — and never one given in the request. Speak to someone you know, ask them to read out the new details, and check the Confirmation of Payee result when you set up the new payee.

What is dual authorisation for bank detail changes?

It means two different people are involved in every change: one verifies or enters the new details and another approves them. Nobody can approve a change they requested or entered themselves, which makes it much harder for a single deceived person to redirect a payment.

Should we make a test payment to new bank details?

A small test payment (for example £1) is a useful extra check for larger or regular payments. It only works if you then ask the supplier, on a number from your records, to confirm the exact amount they received.

What should I do if I think we've paid a fraudster?

Call your bank immediately using the number on your card or the bank's website, or dial 159 — speed matters for recovering money. Then contact the genuine supplier on the details in your records and report it to Action Fraud on 0300 123 2040 or at actionfraud.police.uk (in Scotland, Police Scotland on 101).

Does this also cover employees changing their bank details?

It can. Payroll diversion fraud, where someone poses as an employee and asks for their salary to go to a new account, is common. Tick the staff and payroll option and the procedure adds a section on confirming those changes in person or on a number from the employee's record.

Is anything I enter sent to Paylist?

No. The procedure is generated in your browser. Nothing you type is sent anywhere, and nothing is saved once you close the page.

Check before you pay — every time

Paylist is a verified directory of UK business bank details. Your suppliers list theirs once, and you look them up instead of trusting an email.

Get started