How to Verify Vendor Bank Details Before a Payment Goes Out

Knowing how to verify vendor bank details has become a cost question for small firms, not an IT question. The FBI's latest Internet Crime Report puts business email compromise losses for 2025 at just over three billion dollars. That total comes from nearly twenty-five thousand complaints.

Ransomware looks small beside it in the same document. The report counts more than 3,600 ransomware complaints with losses above $32 million, so reported email fraud losses ran more than ninety times higher.

That gap points at accounts payable rather than at servers. A fake invoice or a changed account number moves money through the company's own bank, signed off by its own staff, and the law treats such a payment very differently from a theft.

We read the 2025 report, an FBI alert on the scheme, this year's Nacha rules for business ACH payers, the wire sections of the Uniform Commercial Code and published terms and guidance from three banks.

Why does business email compromise cost firms more than ransomware?

It costs more because it rides on payments a business already makes. The FBI's report defines the scheme in one line: “BEC is a scam targeting businesses or individuals working with suppliers and/or businesses regularly performing wire transfer payments”.

Business email compromise payment fraud losses have held near three billion dollars a year since 2023.

The ransomware figure is narrower than it looks. The report says its ransomware loss count “does not normally include estimates of lost business, time, wages, files, or equipment,” so much of the true cost of an attack sits outside that number.

Even with that caveat, email fraud is the larger bill.

New tools make the fake requests harder to spot. The report warns that “Chat generators can quickly create official-sounding emails mimicking a company's CEO or other officials,” and it adds that voice cloning can be used to request a wire.

Businesses reported more than $30 million in losses to email fraud with an AI element last year, the report says.

The stolen money often moves through foreign banks as well. The FBI's alert says email fraud has been reported in all fifty states and 186 countries, and it names banks in the United Kingdom and Hong Kong as frequent intermediary stops.

Bank account validation: does the bank check that the name matches the number?

No, and the law says it does not have to. Under Article 4A of the Uniform Commercial Code, a beneficiary's bank that does not know the name and number belong to different people “may rely on the number as the proper identification of the beneficiary of the order”.

Bank agreements repeat the point in plain contract language.

Happen Bank's deposit agreement says that “Neither we nor any receiving or beneficiary bank have any responsibility to determine whether the name and identifying number refer to the same financial institution or person”.

A wire with the right vendor name and a fraudster's account number goes to the fraudster.

That rule moves the whole job of checking onto the payer. The vendor name on a payment order is a label for the people who send it. The routing and account numbers decide where the money lands.

How to verify vendor bank details before paying a new or changed account?

Verify the request through a channel the requester does not control, before the first payment to the new account.

The FBI's alert on the scheme puts it in one line: “Use secondary channels and/or two-factor authentication to verify requests for changes in account information”.

Banks give the same advice in more practical terms.

Mechanics Bank tells business customers that “A payment change request should always put your accounts payable team on high alert,” and it says to call the vendor on the number already in the accounting system.

The phone number printed in the suspicious email is the one to avoid. Mechanics Bank warns that it likely belongs to the fraudster. Replying to the message carries the same risk.

Cloned voices change what a phone call can prove. A callback to a known number still beats a reply to an email, but the FBI's warning about voice cloning means a familiar voice on an inbound call proves little by itself.

Written change controls turn the call into a habit. Nacha, the body that writes the rules for the ACH network, gives an example of what originators can do: “Such procedures could include change controls regarding payment information and instructions for vendor and payroll payments”.

Put together, the guidance points to a short routine. Compare the new details with the file, confirm them by phone with a known contact, and send no money to the new account until that call is done.

Bank account validation adds a second layer, though it answers a narrower question. It confirms that the account details work, not that the request came from the vendor. Nacha's resource page treats it as routine: “Account validation is a best practice for all organizations sending payments”.

The tools vary from one validation provider to the next. Nacha says validation vendors use pools of data, checks of online banking credentials or both, and many also offer prenotification entries or small test deposits.

Those small test deposits now follow a standard format. Under Nacha's micro-entry rule, the credits are usually less than a dollar, carry the description ACCTVERIFY and require the originator to run commercially reasonable fraud detection on them.

One validation rule already binds many online businesses. Since March 2021, Nacha has required originators to validate first-use consumer account information for consumer debits authorized online.

For vendor payments, the limit of validation is the point to remember: a fraudster who controls a mule account can pass a test deposit, so validation belongs next to the callback, not in place of it.

What changed for business ACH payments in 2026?

Nacha's fraud monitoring rules now reach almost every business that originates ACH payments. The first phase took effect in March 2026 for the largest originators, and the second in June, with Monday, June 22 as the practical start because of the federal holiday.

The second phase covers every non-consumer originator below the first-phase threshold of six million ACH payments in 2023, a group that includes small firms paying staff and vendors through their bank's ACH service.

The rule text names the fraud it targets. It defines false pretenses as the inducement of a payment by someone misrepresenting their identity, their authority to act for another person, or the ownership of the account to be credited.

Its guidance then spells out the reach: “This definition covers common fraud scenarios such as Business Email Compromise (BEC), vendor impersonation, payroll impersonation, and other payee impersonations”.

No specific procedure is prescribed by the new rules. They require risk-based processes instead, and Nacha adds that “A risk-based approach should not be used, however, to conclude that no monitoring is necessary at all”.

Account takeovers push the same way toward ACH. The FBI's report says such cases can involve 50 or more ACH transactions to different accounts at several banks at once.

Receiving banks gained a matching duty in the same package. Under the second phase, banks that receive ACH credits must run risk-based monitoring of incoming credits, and Nacha says such a bank may return a suspect entry or contact the sending bank.

JPMorgan's treasury guide tells clients to review that monitoring every year. For a small firm, Nacha's own example points to written change controls and a dated record of each check.

What should a business do in the first hours after a fraudulent payment?

It should call its bank at once and ask for a recall, then file with the FBI. The report's guidance opens with the deadline: “If you discover a fraudulent transfer, time is of the essence”.

The same guidance asks victims to request any indemnification documents the bank needs. It notes that recall policies differ from one institution to the next, and it asks for a complaint at ic3.gov regardless of the amount lost.

Speed shows up in the FBI's own results for the year. Its Recovery Asset Team ran nearly four thousand freeze requests through its Financial Fraud Kill Chain process last year and froze about $679 million of roughly $1.16 billion in attempted theft. That is a success rate of 58 percent. Most of those requests were domestic, with 326 sent abroad.

One published case shows the value of a fast earlier report. In April 2025 an Oregon city government office lost more than $6 million to email fraud, and an earlier freeze on the same recipient account prompted that bank to question the wire.

The wire instructions proved fraudulent, and the originating bank issued a recall for the wire.

A second case from August 2025 involved a home purchase. A wire of more than $449,000 went to a fake account after an email impersonated the buyers' attorneys, and after the complaint the recipient bank reported the full amount still on hold.

Bank contracts can set a far shorter reporting clock than the law. Happen Bank's agreement gives a customer no more than 14 days from notice of a payment order to report an unauthorized or erroneous one, and a late report forfeits interest on any refund.

Who carries the loss when an employee pays a fake vendor?

Usually the business carries it, because its own staff authorized the payment. Article 4A treats a payment order as “the authorized order of the person identified as sender if that person authorized the order,” and a clerk who keys a wire to a fake account has done exactly that.

The refund rule in the same article covers a different case. A bank must refund a payment order that was not authorized and not effective against the customer, with interest.

The customer loses only that interest if it fails to report within a reasonable time of no more than 90 days.

Security procedures can shift the loss further toward the customer. Happen Bank's agreement says a customer who refuses a commercially reasonable security procedure the bank offered will be bound by any order the bank accepts in good faith under the procedure the customer chose, whether or not authorized.

Another clock, this one a full year, applies to objections. Under Article 4A, a customer who received notice identifying a payment order cannot dispute the bank's right to keep the payment unless it objects within one year after that notice.

Nacha's false pretenses definition gives these cases a name but not a refund. It separates payments induced by false pretenses from unauthorized entries, and it excludes scams over fake or poor-quality goods.

What do the published numbers leave out?

They leave out the size of the victims. The parts of the FBI report we read count complaints and losses by crime type and age group, not by company size, so the share falling on firms with five to fifty staff is not visible.

The FBI figures count only what victims choose to report. Ransomware losses exclude downtime and recovery costs, and frozen funds are not the same as money returned to the victim.

The AI figure is a floor as well. The report notes that many victims do not realize how far AI may be involved in the scams they report.

No source we read measures how often a callback to a known number stops a fraudulent change, so the bank guidance and the Nacha rules rest on practice rather than published test results.

A bank's fraud or treasury team can confirm which recall and security procedures apply to an account, and an accountant can set the approval steps for vendor changes. A lawyer is the right call once money has gone to the wrong account.

Where does this leave a small firm's payables desk?

Our view at the desk is that vendor bank changes now deserve the same control as a new hire on payroll. The losses are larger than ransomware, the law puts them on the payer, and the 2026 Nacha rules make monitoring a duty for almost every business that pays by ACH.

The cheapest control is a phone number already on file. A written rule that no new account receives a dollar before a callback to a number on file costs nothing, and it answers the gap that Article 4A leaves open when banks pay on digits alone.

Speed is the second control, and the clock starts at discovery. The FBI froze more than half of the money in the cases it worked through its fraud process in 2025, and it says complaints filed as quickly as possible help that process.

Regulators are still working on payments fraud more broadly. The Federal Reserve, the FDIC and the OCC asked for public comment in 2025, and in September 2026 the agencies and FinCEN clarified what banks may tell customers about suspected fraud.

Until the rules shift the risk of authorized push payments, the cost of a fake vendor email stays with the business that paid it, and the only control fully in its hands is the check made before the money moves.