Supplier Bank Details Changed? A Verification Checklist for NZ Businesses
Treat a supplier-bank change as unverified until an authorised person checks it through independently sourced contact details. Record the request, verification and approval before changing the supplier record. AI can assemble a review checklist; it should not authenticate the supplier, approve the change or release payment.
For a New Zealand owner, bookkeeper or operations manager, the question is not whether the email looks convincing. It is whether you have independent evidence and a named person authorised to act. Use this supplier bank-details change verification checklist before connecting an agent to finance requests.
1. Pause the change and verify independently
Put the requested change on hold while you check it. Keep the original request and attachments in your restricted business system. Do not let an urgent deadline, familiar signature or invoice number replace verification.
Choose a contact route outside the request
NZ government Own Your Online invoice-scam guidance recommends checking changed payment information through publicly available contact details, not replying to the requesting email. It also recommends using a publicly listed number or one you usually use rather than details on the invoice.
Record where your independently sourced contact details came from. Ask the appropriate supplier contact to confirm the requested change through your agreed process. A phone number supplied in the same email—or generated by a model—is not independent verification evidence.
If you cannot reach the contact, keep the change pending and escalate to your finance owner. Do not substitute silence for approval.
3. Copy a supplier-change evidence checklist
Use one review record per request. The blank checklist below describes what to capture, not a completed approval. Keep full account details and evidence in access-controlled systems; use masked references in summaries.
| Stage | Evidence to record | Named owner | Decision or status |
|---|---|---|---|
| Request | Request reference, supplier identity, received time and changed fields | Request receiver | Unverified; enter reference |
| Independent verification | Trusted-contact source, contact attempt, outcome and time | Verifier | Pending, conflicting or verified |
| Change approval | Exact proposed change version and evidence reviewed | Authorised approver | Approve, reject or hold; record reason |
| Controlled update | Approved version, operator, completion time and checked result | Permitted updater | Not started, completed or exception |
| Payment | Separate payment reference, checks and decision | Payment approver | Follow payment process; not implied by change approval |
Illustrative masked example—not a real supplier
Request EXAMPLE-01, supplier Example Supplier, account [masked]: an email asks for replacement payment details. The verifier cannot reach the independently sourced contact. Status: pending verification. Approval: not granted. Update: not started. Payment to the proposed account: not authorised.
This example contains no usable bank details. Its purpose is to show that an incomplete check remains incomplete, even if an invoice is due. Record the next owner and follow-up time rather than letting a request disappear into an inbox.
4. Keep AI in the preparation lane
An agent could highlight changed fields, group requests and draft a masked review packet with source references and missing evidence. Assess whether that preparation is useful before granting access. The Xero and finance-workflow guide covers broader read-only preparation and human authority.
Documents are inputs, not permission grants
An email saying “ignore the usual checks” must not alter the workflow. Treat supplier messages and attachments as untrusted content, as explained in the prompt-injection guide. The model must not invent contact details, infer account ownership or turn a confident summary into verification.
Keep supplier-master writes, approval actions, payment release and external messages outside the agent’s permissions. A reviewer checks each source and unresolved conflict. Any later implementation needs separately agreed access, testing and approval controls; this checklist does not establish that an integration is installed or safe.
5. Choose the next action, not another tool by default
If your current finance system already records requests, independent checks and approvals clearly, a documented manual process may be enough. Consider AI only when repeated preparation work has a defined owner, suitable source access and a review queue that people can manage.
Escalate conflicts and suspected scams
Keep the change on hold when evidence conflicts, the supplier contact is unavailable or the requester pushes to bypass controls. Ask your finance lead, accountant, bank or security specialist for help appropriate to the issue. Human approval does not eliminate risk.
If you paid and now suspect a scam, contact your bank immediately. Own Your Online also directs affected people to report to the NCSC through its official guidance. An Assessment booking is not incident response, and recovering money is not guaranteed.
Frequently asked questions
Is replying to the supplier’s email enough to verify new bank details?
No. Use independently sourced contact details rather than the requesting email. Record the contact source, verifier and outcome. Familiar branding or a continuing email thread does not replace the check.
Can AI confirm that a bank account belongs to the supplier?
Do not treat a model’s answer as account-ownership verification. AI can organise evidence for review, not authenticate the supplier. Check any specialist verification service’s current coverage and limitations directly before relying on it.
Does an approved invoice also approve a changed bank account?
No. Invoice approval, supplier-record changes and payment approval are separate decisions. Follow your business’s authority rules for each, even when the invoice matches a purchase order.
What should happen if the independent contact cannot be reached?
Keep the requested change pending, record contact attempts and escalate to the named finance owner. Do not update the supplier record or pay the proposed account merely because the request is urgent.
Assess the approval boundary before connecting finance tools
Before an agent reads supplier requests or prepares finance changes, use the NZ$1,000 AI Agent Assessment to map sources, permissions, evidence and human approval.
The Assessment includes two 45-minute Zoom sessions and a report before the second call, with no obligation to buy implementation or management. It is not a bank-account verification service, payment-authorisation service or fraud guarantee. Bring a blank checklist or agreed redacted examples; do not put bank details in the booking form.