A Malaysian SME receives an email from a familiar supplier two days before a major payment is due. The message refers to a genuine invoice, uses the supplier’s usual email signature and explains that payments must now go to a different bank account.
The accounts assistant updates the banking details and prepares the transfer. Nothing about the invoice amount or goods delivered has changed. But one question remains unanswered: did the supplier actually authorise the new account?
Supplier bank account change fraud exploits precisely this gap. A payment can be supported by a legitimate purchase order, correct delivery documents and an authentic invoice, yet still be diverted to a criminal’s account.
For SMEs managing supplier payments across Malaysia, Singapore and Southeast Asia, preventing this type of fraud requires more than checking whether an email looks genuine. It requires a controlled method for verifying who requested the change, who approved it and which account ultimately received the money.
What Is Supplier Bank Account Change Fraud?
Supplier bank account change fraud occurs when criminals deceive a business into replacing a legitimate supplier’s payment details with fraudulent banking instructions.
It is a common form of business email compromise, or BEC. Criminals may impersonate suppliers, compromise genuine email accounts or create addresses that closely resemble legitimate business domains.
Singapore Police Force’s Annual Scam and Cybercrime Brief 2025 recorded 377 business email compromise cases and S$35.3 million in reported losses during 2025. These figures cover reported cases in Singapore and should not be interpreted as losses suffered exclusively by SMEs.
Malaysia’s Royal Malaysia Police has similarly warned that business email compromise can involve impersonation, phishing, manipulated communication and unauthorised access to genuine corporate email accounts.
The important lesson is that a familiar sender name, correct invoice reference or apparently genuine email conversation does not independently authenticate a change in payment instructions.
How Payment Diversion Happens in a Real SME Workflow
Consider a hypothetical Malaysian packaging distributor purchasing goods from a long-standing overseas supplier.
- The distributor receives a legitimate invoice for an agreed shipment.
- Shortly before payment, an email arrives announcing revised bank details.
- The message includes the correct supplier name, invoice reference and payment amount.
- An employee updates the supplier record in the accounting system.
- A manager approves the payment after confirming the invoice amount.
- The money is transferred to an account that does not belong to the supplier.
Every employee may believe they followed the usual process. The failure occurs because invoice approval and bank account authentication are different controls.
Matching an invoice against a purchase order confirms whether a payment obligation appears legitimate. It does not establish that the bank account receiving the money belongs to the intended supplier.
Seven Warning Signs SMEs Should Investigate
- Unexpected account changes: A supplier suddenly requests payment to an account not previously registered.
- Urgent deadlines: The sender insists that payment must be completed immediately to avoid disruption.
- Unusual account ownership: The beneficiary name differs from the supplier’s legal entity without a satisfactory explanation.
- Changed contact instructions: The email asks employees to stop using their established supplier contact.
- Altered email domains: The sender’s address contains a subtle spelling difference or unfamiliar domain.
- Unusual geographic arrangements: Payment is redirected to a different country without a documented commercial reason.
- Confidentiality demands: The requester discourages employees from consulting management or other supplier representatives.
None of these signs proves fraud by itself. Genuine suppliers sometimes change banks, restructure their businesses or update their treasury arrangements. The appropriate response is independent verification, not an automatic accusation.
The SME Payment Change Verification Framework
A practical payment safeguard can be organised around five controls: Pause, Verify, Authorise, Record and Release.
| Control | Required Action | Responsible Person |
|---|---|---|
| Pause | Hold payment to the proposed new account until verification is complete. | Accounts payable |
| Verify | Contact the supplier through a previously trusted channel. | Procurement or designated verifier |
| Authorise | Obtain documented approval from an authorised person independent of the change request. | Finance manager or owner |
| Record | Preserve the request, verification evidence and approval history. | Finance administration |
| Release | Confirm the approved beneficiary before submitting the payment. | Authorised payment approver |
This framework does not require sophisticated software. A small company can begin with a controlled supplier register, a documented verification checklist and clear approval responsibilities.
1. Pause Every Unverified Bank Account Change
When a supplier requests different payment details, the employee receiving the instruction should not immediately amend the accounting record.
Instead, place the proposed change in a pending status. If payment is already scheduled, hold the affected transfer until verification is completed.
The hold should apply to the new beneficiary instruction, not automatically to every transaction involving the supplier. Management should review any contractual payment deadline and communicate promptly with the legitimate supplier where necessary.
2. Verify Through an Established Communication Channel
Independent verification is the most important step.
Contact the supplier using a telephone number or verified contact method already held in the company’s supplier master record, signed agreement or previously authenticated onboarding documents.
Do not rely solely on a telephone number provided in the suspicious email. Replying to the same email thread is also insufficient because a genuine supplier mailbox may have been compromised.
Ask an authorised supplier representative to confirm the proposed account change, beneficiary identity and effective date. For higher-risk transactions, require additional confirmation from an established finance or management contact.
3. Separate the Person Requesting the Change From the Approver
A common weakness in smaller companies is allowing one employee to receive a request, update the supplier master record and release the payment.
Where staffing permits, divide these responsibilities. The accounts assistant may register the change, procurement may verify the supplier and a finance manager may authorise the updated beneficiary.
Very small businesses can still create separation by requiring the owner or another authorised person to independently review the evidence before payment.
The approver should inspect the verification record, not merely accept a message stating that the change has been checked.
4. Preserve Evidence of the Change
Keep the original request, the identity of the employee who received it, the date of independent verification, the contact method used, the authorised supplier representative and the internal approval.
Where applicable, retain supporting documentation explaining a legitimate change in the supplier’s legal entity or banking arrangements.
Store sensitive bank details securely and restrict access to employees who need them. A verification register should support accountability without exposing banking information unnecessarily.
5. Check the Beneficiary Again Before Releasing Payment
Even after the supplier master record is updated, the payment approver should compare the final beneficiary details with the independently verified information.
This is especially important when bank files are uploaded manually, payments are prepared through spreadsheets or staff can overwrite account details during transfer preparation.
Where the banking platform provides beneficiary-name matching or other validation features, use them as an additional safeguard. Such features do not replace independent supplier verification.
A Practical Supplier Bank Detail Change Register
SMEs can use the following structure to maintain an auditable record of proposed changes.
| Field | What to Record |
|---|---|
| Supplier identifier | Approved supplier name and internal vendor code |
| Change request | Date received and original communication reference |
| Proposed beneficiary | New bank and account details in a restricted record |
| Independent verification | Trusted contact used, date and confirmation outcome |
| Internal approval | Approver, decision and approval date |
| Effective status | Pending, rejected or approved |
| First payment review | Confirmation that the transfer matches the approved beneficiary |
For example, an SME may receive a legitimate account change request on Monday, complete independent verification on Tuesday and authorise the new account on Wednesday. The register should make that sequence understandable to another employee or auditor.
Bank account changes should not become effective merely because someone has entered new information into the accounting system.
Design an Approval Matrix That Fits the Business
Not every supplier payment carries the same risk. A company can distinguish routine payments to established accounts from changes involving new beneficiaries, unfamiliar jurisdictions or unusual urgency.
| Situation | Suggested Control |
|---|---|
| Routine invoice, unchanged approved account | Normal invoice matching and payment approval |
| Existing supplier requests new bank details | Independent verification and separate approval |
| New supplier onboarding | Supplier identity checks and beneficiary verification |
| Urgent payment to a newly changed account | Enhanced management review before release |
| Account ownership or legal entity mismatch | Hold and investigate supporting documentation |
Businesses should establish their own monetary thresholds and approval authorities according to payment exposure, staffing, banking arrangements and operating risks.
A small payment is not automatically safe. Criminals may test procedures using lower-value transactions before attempting larger diversions.
What If the Request Comes From the Supplier’s Real Email Account?
Employees sometimes assume that a message must be authentic because it appears within an existing email conversation.
That assumption is dangerous. Attackers who gain access to a supplier’s mailbox may observe genuine invoices, payment schedules and correspondence before inserting fraudulent instructions.
The message may contain no spelling mistakes or suspicious attachments. It may even be sent from the supplier’s actual email address.
Therefore, the control should not depend exclusively on identifying suspicious language. Any material change to payment destination should trigger verification outside the email conversation, regardless of how professional the message appears.
SMEs should also protect their own email accounts using multifactor authentication, strong access controls, prompt removal of departed employees’ access and staff awareness training.
What Should an SME Do After a Suspected Fraudulent Transfer?
If a business discovers that money may have been sent to a fraudulent account, speed matters.
- Contact the sending bank immediately. Explain that the transfer may involve fraud and request available recall, tracing or protective procedures.
- Notify the appropriate authorities. Use the official police, cybercrime or scam-reporting channels applicable to the country and transaction.
- Preserve the evidence. Retain emails, payment confirmations, account-change requests, call records and relevant system logs.
- Secure affected accounts. If email compromise is suspected, involve the IT provider or security team to protect accounts, sessions and credentials.
- Notify the genuine supplier. Establish whether its communication systems or payment instructions were compromised.
- Review pending payments. Check whether other supplier records or transfers may have been altered.
- Document the incident. Record the timeline, affected transactions, response actions and process weaknesses.
Recovery is not guaranteed. The options available depend on the payment method, receiving institution, jurisdiction and how quickly the incident is reported.
Businesses should use independently verified official contact channels rather than numbers or links supplied in suspicious messages.
How SMEs Can Measure Whether Payment Controls Are Working
A payment verification procedure should produce evidence that it is being followed.
Four useful management indicators are:
- Verification completion rate: The percentage of bank account change requests independently verified before approval.
- Unapproved change attempts: The number of attempted supplier master-record changes without the required authorisation.
- Payment exception rate: The proportion of payments held because beneficiary details or supporting records do not agree.
- Exception resolution time: The time required to investigate and resolve legitimate payment changes.
These indicators should be interpreted together. A rise in detected exceptions may reflect stronger controls rather than increasing fraud.
Management should investigate repeated exceptions, unexplained overrides and cases where payment was released before verification was complete.
The objective is not to eliminate every administrative delay. It is to prevent avoidable losses while allowing legitimate supplier payments to proceed reliably.
A 30-Day Implementation Plan for Small Businesses
Week 1: Identify Payment Exposure
List the employees who can create suppliers, change bank details, approve invoices and release bank transfers. Review whether the same person can complete all these activities without independent oversight.
Week 2: Establish Supplier Verification Records
Review existing supplier master data and identify trusted contact details. Introduce a controlled process for verifying new suppliers and changes to beneficiary information.
Week 3: Introduce Approval and Escalation Rules
Define who may approve bank changes, how urgent requests are handled and when management must intervene. Train finance, procurement and relevant operational staff using realistic payment-change scenarios.
Week 4: Test the Process
Review a sample of recent supplier changes and payments. Confirm that verification evidence exists, approvals were obtained and the final payment beneficiaries match authorised records.
Document weaknesses and assign corrective actions. Repeat the review periodically and after significant staffing or system changes.
Why Reliable Financial Controls Also Matter for Business Credibility
Reliable payment records support more than fraud prevention. They help SMEs establish a dependable operational history, reconcile transactions and explain business performance with confidence.
A company claiming exceptional transaction volume, rapid expansion or another significant commercial milestone should distinguish genuine completed activity from duplicate, cancelled or incorrectly recorded transactions.
Some businesses may also consider independent recognition for exceptional, measurable achievements. Asia Record’s official website provides the Asia record application process for businesses and other applicants proposing achievements supported by evidence.
Companies exploring business achievement recognition in Asia should understand that a record claim requires appropriate definition, measurement and verification. An Asia Record holder’s recognised achievement does not automatically demonstrate strong cybersecurity, profitability, financial stability or compliance.
For SMEs considering company recognition in Asia, sound internal records can make genuine business claims easier to substantiate. However, payment-control effectiveness and record eligibility are separate questions.
The immediate priority remains protecting the company’s money and ensuring that legitimate suppliers receive their payments.
Frequently Asked Questions
How can an SME verify a supplier’s new bank account?
Contact an authorised supplier representative using previously trusted contact information. Confirm the account change independently, retain evidence of verification and obtain internal approval before updating the beneficiary record or releasing payment.
Is an email from a known supplier enough to approve new bank details?
No. A genuine email account can be compromised. A bank-detail change should be verified through a separate trusted channel, even when the message appears within an existing conversation.
Can accounting software prevent supplier payment fraud?
Accounting software can support access restrictions, approval workflows and audit logs. However, employees must still authenticate payment changes and investigate exceptions. Software does not independently establish that a new bank account belongs to the intended supplier.
Should SMEs verify every supplier invoice by telephone?
Not necessarily. Routine payments to unchanged, previously approved beneficiaries can follow normal invoice and payment controls. New suppliers, changed bank accounts and suspicious instructions warrant additional verification.
What should a business do if it has already transferred money to a fraudulent account?
Contact the bank immediately, report the suspected fraud through appropriate official channels, preserve evidence and secure potentially compromised systems. Recovery cannot be guaranteed.
Make Bank Account Verification a Non-Negotiable Payment Control
Supplier fraud often succeeds because employees concentrate on whether an invoice is valid without separately confirming where the money will go.
For SMEs, the most effective starting point is a simple rule: no supplier bank account change becomes effective until it has been independently verified and properly authorised.
Combined with secure email practices, controlled supplier records and clear payment approval responsibilities, that rule can substantially strengthen the way a business handles one of its most sensitive daily activities.
A growing company needs reliable suppliers, accurate records and disciplined payments. Protecting those foundations is more valuable than processing a suspicious transfer a few minutes faster.
