Vendor bank change policy (free template)

Copy this into your AP procedures. It's short on purpose so people actually follow it.

COPY
  1. We never change vendor bank details based on email, text or a phone call we didn't place.
  2. We verify by calling the vendor on a phone number already in our records (not one in the request).
  3. A second person approves the change in writing and logs date, caller and contact.
  4. The first payment to new details is held for review, or sent as a small test amount first.
  5. Any urgency, secrecy or new-country bank is escalated to the owner/controller.

Use the free bank-change checklist

Already paid? Check for repeats with the free duplicate invoice checker · signs of a fake bank change.

FAQ

Is an email from the vendor enough to change bank details?

No. Business email compromise often uses real or look-alike vendor email. Call back on a number you already had on file.

Who should approve a bank change?

Someone other than the person who received the request; two people is the usual minimum.

General guidance, not legal or security advice.