A supplier bank detail change verification checklist is the set of checks completed before any new account details are saved to the supplier master: who asked, how the request arrived, an independent call-back to a known contact, a second person's approval, and a hold on the first payment. An AI agent can gather and flag; people verify and approve.
Why does this one change get its own checklist?
Changing where a supplier is paid is the single most common entry point for payment fraud. A fraudster does not need to break into your systems. They need one convincing email, apparently from a real supplier, asking you to "update our bank details". Every invoice after that is paid to them.
That is why we argue supplier bank detail changes are where finance agents must stop. An agent reading an inbox will meet these requests constantly, and some will be fraudulent. The checklist makes sure an agent's helpfulness never becomes the fraudster's route.
When should you use it?
For every change to a supplier's payment details, without exception: new account, new bank, new currency account, new payment reference. Also use it when a new supplier is set up, because a new supplier's details are a change from nothing.
Do not skip it for long-standing suppliers or small amounts. Fraudsters target long-standing suppliers precisely because you trust them.
How do you fill in each check?
- Request source records exactly how the request arrived. An email, letter or invoice is external information; it proves nothing about who sent it.
- Contact used for call-back must come from your own records, set up before the request. Never use a phone number from the request itself.
- Confirming person must be someone at the supplier you already know, not whoever answers.
- Account name check compares the account holder's name with the supplier's legal name. In the EU, payment service providers must offer payee name verification for instant payments, which helps, but it does not replace the call-back.
- First payment hold keeps the first payment to new details small or held for confirmation of receipt.
What an agent may do here is covered in whether an AI agent can change supplier bank details. Our answer: it may detect, gather and draft, never save.
The checklist
| No. | Check | Who | Evidence |
|---|---|---|---|
| 1 | Request logged with date, channel and sender | Agent or AP clerk | Copy of request |
| 2 | Request compared with prior correspondence for anomalies | Agent | Anomaly note (domain, tone, urgency, timing) |
| 3 | Supplier's known contact retrieved from master record | Agent | Contact record, date created |
| 4 | Call-back made to known contact, not to request details | Person | Call note: who, when, what confirmed |
| 5 | New details confirmed by the supplier on the call | Person | Call note |
| 6 | Account holder name matches supplier legal name | Agent or person | Name check result |
| 7 | Supporting document on supplier letterhead obtained | Person | Document reference |
| 8 | Change entered by vendor master team | Person | System change log |
| 9 | Change approved by second person | Person | Approval record |
| 10 | Supplier's previous contact notified of the change | Person | Notification sent to old details |
| 11 | First payment to new details flagged in payment run | Agent | Flag on payment |
| 12 | Receipt of first payment confirmed by supplier | Person | Confirmation note |
A worked sample
A hypothetical construction firm. An email arrives from what looks like a steel supplier's accounts team.
| No. | Entry |
|---|---|
| 1 | Email received Tuesday 4.40pm, from accounts address at supplier's domain |
| 2 | Agent flags: sending domain differs from the usual by one character; email marked "urgent, before Friday's run"; no prior change in four years |
| 3 | Known contact: credit controller, phone number on file since onboarding |
| 4 | Call-back Wednesday 9.10am by AP lead to number on file |
| 5 | Credit controller confirms no change requested |
| 6 | Not reached |
| 8 | No change made |
| 10 | Supplier told of attempted fraud |
The checklist ended at step 5, which is the point. The agent's anomaly note at step 2 helped, but the call-back at step 4 decided. The detailed process is in how to verify supplier bank detail changes with an AI agent before anyone pays.
Where Pryme fits
In Pryme, the email carrying new bank details is an external fact. It cannot authorise a payment and cannot alter the supplier master. Writing to the master is outside every finance agent's role scope, so any attempt is refused and filed. The finance guide, books you can audit, covers the wider model.
Questions people ask
What if the supplier insists there is no time for a call-back?
Hold the payment. Urgency is one of the strongest signs of fraud, and a genuine supplier will accept a short delay to protect their own money.
Should new suppliers go through the same checks?
Yes, plus ownership checks on the supplier itself. The beneficial ownership verification checklist covers that side.
Can the agent make the call-back?
No. The call-back exists because a person recognises a voice and asks unscripted questions. An agent making the call would remove the very check that defeats impersonation.