The incident: an invoice directed payment to an attacker
The group’s owner described a phishing incident in which the bank account number on a supplier invoice was changed to the attacker’s account. The document still served as a request for payment, but the banking details pointed to a different recipient.
That exposed a gap in the invoice process. The admin team needed a way to check the account it was being asked to pay against the supplier’s details before approving payment.
“Unfortunately we were hit by a phishing link that changed an invoice bank account number from supplier's to the attacker's. This made us realize we needed to check every single invoice that the bank info matches the supplier info.”
The decision: check every supplier invoice
After the incident, the group decided that each invoice needed a bank-details check. The owner’s concern extended to invoices from known suppliers: a familiar business name on the document could still sit above a substituted account number.
VerifyNow bank account validation became part of the admin team’s invoice process. It gives the team a bank response to review when deciding whether the supplied banking details match the person or business due to receive payment.
What bank account validation checks
A bank validation request uses the supplied bank account details and the intended account holder’s identity or company information. The responding bank returns the supported account and matching results for the team to assess.
Depending on the bank and the check, the result can include whether the account exists and is open, together with the returned account-holder or identity matches. A mismatch flags details that need investigation. An unavailable result leaves a question for the team to resolve before relying on the check.
This addresses the risk raised by the owner: an invoice can name the correct supplier while asking the dealership to pay an account belonging to someone else.
Where the check fits before payment
The owner’s account establishes the requirement to check every invoice. For an admin team applying that control, the bank result sits alongside the invoice approval:
Compare against the intended supplier
Use the supplier’s established identity or company information with the bank details on the invoice. This gives the check a known account holder to compare against.
Review the returned matches
Read the result for each field the bank returns. An existing, open account still needs to match the intended recipient.
Investigate a change or mismatch
Put the payment on hold and confirm the details through an established supplier contact. An email requesting the change can itself be part of the fraud.
Complete the invoice approval
The person approving payment reviews the bank result with the supporting invoice. The business still needs to confirm that the goods or services were supplied and that the amount is due.
The owner’s feedback
The owner says VerifyNow has helped streamline invoicing within the admin team. Having a bank response to review gives the group more confidence in its checks before payment.
Describing how the team feels about the change, the owner adds: “we feel a lot more reassured.”
The owner says the impact cannot yet be measured. The reported outcome is a clearer invoice process and greater reassurance for the team; the financial impact remains unmeasured.
Bank account validation checks the banking details supplied for a payment. Invoice approval also depends on confirming that the invoice is genuine and the payment is owed.
Applying the same control to supplier payments
This case centres on a motor dealership group, but the payment risk applies to any business paying supplier invoices. Checking the account details before release gives the finance team a chance to identify a mismatch while it still controls the payment.
VerifyNow provides bank account verification through the dashboard and supported APIs. Teams can review the bank verification API documentation when assessing how the check could fit into their own payment process.