Supplier Bank-Detail Changes: Test the Approval Without Moving Money

A supplier asks your accounts-payable team to use new bank details for the next invoice. The message references work everyone recognizes. Someone calls to say the update is urgent. By the time the request reaches a reviewer, the ticket already says “supplier confirmed.”

The useful question is what that confirmation covers. Did someone establish who requested the change? Did an authorized person approve the specific edit? Has anyone separately approved a payment using the updated record? A single checkbox can conceal three different decisions.

You can examine those decisions without moving money. Use two fictional supplier records, a sample change request, and the real procedure owners. The exercise below tests whether the team can explain and preserve each approval boundary.

How vendor impersonation reaches finance

The FBI’s business email compromise guidance describes criminals posing as familiar business contacts, including vendors, to induce fraudulent payments. The approach can involve spoofed addresses or access to genuine business correspondence. The FBI recommends independently verifying payment requests and changes to account numbers or payment procedures, and obtaining contact information independently of the suspicious request. FBI: business email compromise

Adapt the exercise below to the finance system and approval chain your organization actually uses.

Changing bank details and approving payment

Supplier master data is the standing information an organization keeps about a supplier, such as its identity, contacts, and payment destination. Changing that information can affect later transactions even when no payment occurs during the change itself.

A payment approval concerns a particular proposed payment under the organization’s rules. In this review, keep that authority separate from permission to edit supplier information. Ask the finance owner to explain how their system and procedure implement the distinction, including any exceptions. Do not assume a specific product prevents the same person from performing both actions.

The first question is verification: what connects the request to the supplier through an approved route? The second is change authority: who may approve this edit to this record? The third is transaction authority: what additional basis would permit a payment using the resulting data?

Our callback contact-source guide explains why a number supplied in the disputed request is a weak basis for independent verification. Apply that question to the supplier contact record, then continue into the finance decisions rather than treating a completed phone call as the entire control.

The dotted payment boundary in the diagram is a discussion point. The exercise stops before either a production supplier edit or a transaction. Participants identify the approval that would be needed next; they do not execute it.

Give the team two fictional supplier records

The records below are fictional. “Destination A” and “Destination B” are paper labels; no bank accounts or transactions are involved.

For both records, provide a sample invoice and a message requesting the change. The invoice establishes the business context for discussion. It does not independently validate the replacement destination. Give participants access to the procedure and a named finance exception owner so that escalation is possible.

Keep the pressure comparable. If one case supplies an accessible verification route and the other supplies only an urgent message, the exercise is testing different conditions. Record that difference rather than presenting the result as a ranking of employees.

Work Record A through the decisions

The reviewer locates the established vendor contact and follows the approved verification procedure. In the fictional case, the supplier representative confirms a request to update the payment destination. Record the verification result and reference the source used; avoid copying sensitive contact details into the training report.

Now ask who approves the master-data edit. A genuine supplier request does not decide which employee may authorize the internal change. The reviewer identifies the responsible role and the evidence that role requires. If the procedure calls for a second reviewer, name what that person must check rather than recording only that a second name appears on the ticket.

Participants can confirm that the proposed edit has the approvals required by the exercise. That does not show whether the production system enforces those permissions. Keep the sample record unchanged until the facilitator’s agreed point, and mark any paper amendment as an exercise artifact.

Finally, ask what would authorize the next payment. Participants should identify the separate transaction review required by their procedure. This is where a familiar invoice can produce an unsafe shortcut: the fact that a payment is normally due does not settle the validity of a newly proposed destination.

Hold Record B without losing ownership

Record B presents a more subtle problem. The reviewer finds a contact in the usual system, but its source is the same unresolved request. Calling it would establish reachability at that number; it would not add an independent supplier connection.

In the fictional outcome, the reviewer holds the proposed edit and assigns the missing contact verification to the vendor-management owner. The existing destination remains unchanged in the exercise. No payment instruction is issued.

The finding should state the unresolved dependency: “Replacement contact entered during the request; approval history unavailable; destination change held pending verification through the established vendor-management route.” That is more useful than “fraud caught,” because the exercise has not established that the requester was fraudulent.

A legitimate supplier can change contact details too. Ask the exception owner how that situation is resolved. The route should allow a supported change eventually, while preventing the new contact from approving its own introduction and the associated payment-destination change in one circular check.

Record which decisions the exercise tested

Use the supplier-change review sheet to keep the three decisions visible:

The sheet includes a field for the last action actually performed. A discussion-only exercise supports conclusions about participant decisions and procedure clarity. A separately approved sandbox test can examine application permissions, but its result still belongs to that configured environment. Neither demonstrates that money could have been diverted from production.

For an incident involving a real transfer, leave the exercise process and activate your incident response procedure. The FBI advises contacting the financial institution immediately and reporting the matter to IC3. Do not wait for an internal tabletop review to finish. FBI: reporting business email compromise

Repeat the check after the fix

If the contact history was unavailable, make its source and approval history accessible, or fix the escalation route, then repeat Record B. If reviewers treated supplier confirmation as internal approval, clarify who can authorize the specific edit and test that decision again. If the transaction authority was unclear, ask finance to demonstrate it separately using sample records.

Include Record A in the retest. A process that holds every request indefinitely may reduce one exposure while making ordinary supplier administration unworkable. The desired result is a supported change moving through its approved route and an unresolved change remaining pending with a responsible owner.

The final record should show which request was verified, which edit was authorized, and which payment decision remained untested.