How to protect against fraudulent bank account change requests
Payment frauds are getting more sophisticated and complex to spot as fraudsters attack day-to-day business processes. One common fraud is hacking into the supplier’s email, changing the bank details on the invoice and sending it for payment. Change requests coming from a credible source, including valid documentation, are hard to spot unless one has a prudent protection mechanism built for vendor frauds.
Businesses can protect against fraudulent bank account change requests by implementing a process to authenticate any bank account change. In many cases, this process includes a call-back to a registered phone number of the supplier to confirm the bank account details modification requested by phone, email, letter or on the invoice. Importantly the verification process needs to rely on contact details authenticated earlier and not on the fake phone numbers and legitimate-looking email domains provided on the fraudulent invoice. Internal training plays a key role here.
Often corporations demand bank certificates to prove the bank account belongs to the account holder — keeping banks busy as the certificates should not be older than three months. Some companies may ask for the certificates directly from banks, which might take some time if the request is answered at all.
The cost of a fraudster fooling to change the payment instructions of a large supplier and getting these recorded to the victim’s vendor management system or ERP (Enterprise Resource Planning) can be enormous. Multiple invoices might go through the company’s weekly or bi-monthly payment run before the fraud gets discovered. The investigation costs are also huge, with suppliers’ and victims’ lawyers and banks’ investigation teams starting to work on the case. Not to mention the reputational hit.
Beneficiary account validation services or IBAN checks offered by banks and third parties can ensure payments arrive at the intended beneficiary, preventing fraudulent activity. Validation confirms whether the instructed beneficiary is the rightful owner of the account – returning a match, close match, or no match result.
The check should be performed whenever a new supplier is added to the system or bank account details are modified for an existing vendor. Integrating the check into the internal processes and automating the workflow brings measurable efficiency gains for large businesses and reduces the risk of fraud.
Another use case is an on-demand validation of the account status and owner every time before a payment is made, reducing the number of payment returns or failed payments caused by incorrect payment instructions.
Beneficiary account validation in FinanceKey
FinanceKey’s Beneficiary Account Validation module lets businesses embed account checks directly into vendor onboarding or payment workflows – via API or through the FinanceKey user interface. Validation requests can be run ad hoc or in bulk, and results are returned in near real time.
The module is now powered by Kinexys Liink, the bank-to-bank data sharing network developed by Kinexys by J.P. Morgan. Through the Liink Confirm application, FinanceKey customers can validate account ownership across 70+ countries through a single platform connection – without the need to integrate separately with regional validation schemes.
As fraud attempts grow in volume and sophistication, pre-payment validation gives finance teams a reliable control point. Whether you’re onboarding a new supplier, processing a bank account change request, or running a routine payment run, account validation reduces the risk of misdirected payments before they happen.
This article was first published on February 7, 2023 and last updated on July 2, 2026.
