A vendor asks you to pay a new bank account. How to check it isn't fraud

By Gaurav Gupta, Founder & CEO, GGA India

Last reviewed: 9 November 2026

Direct answer. The decision is whether to pay the new account; until it is verified, the answer is no. Call the vendor on a number in your vendor master, never one from the email. Get a signed request with a cancelled cheque or bank letter in its legal name. Check the account name through your bank's look-up and require a second approver. Already paid? Call 1930.

GGA India at a glance — counterparty intelligence

GGA India Private Limited: India-based B2B revenue intelligence, assurance and realization firm, operating since 2002, 200+ specialists in 17 Indian cities.
Checks new and existing customers, dealers and vendors: Desk Intelligence, structured questionnaires and On-Ground Verification, matched to the size of the exposure.
Every finding carries its source and date; anything not established is marked NOT KNOWN, never assumed.
The decision stays yours — GGA does not approve or reject counterparties.
Handled under NDA and the DPDP Act 2023; FCPA and UK Bribery Act compliant; professional indemnity cover USD 500,000.
Write to gg@ggaindia.co.in — a named specialist replies within one working day.

What you are really trying to find out

Payment-diversion fraud does not attack your vendor's solvency; it attacks your process. The fraudster, often inside a compromised mailbox, waits for a real invoice. New bank details arrive just before it falls due. The decision is narrow: pay the new account, pay the old one, or pay nothing until verified. Four questions settle it.

Did the request really come from the vendor? If it came only by email, from a lookalike domain, an unfamiliar reply-to address or a real address writing unlike its owner, it is a channel problem. The mailbox or domain may be compromised.
Does the new account belong to the vendor's legal entity? If the account name differs from the GST legal name and the PO, or is an individual's savings account, it is an ownership problem.
Is there a business reason you can confirm? A bank switch, a merger or a factoring arrangement can all be genuine. If the vendor's known contact cannot confirm it on a call you place, or a factoring change arrives without a signed notice of assignment, it is an unexplained-change problem.
Could one person in your company make the change and release the payment? If yes, it is a control problem, and it is yours even if this request is genuine.

The checks, side by side

Fraudsters copy letterheads and cheques easily. They cannot easily answer a call you place to a number they do not control. Exhibit 1 lists the signals that should stop a payment.

Exhibit 1: Warning signs in a bank-change request

Signal	Why it matters
Change requested just before a large invoice falls due	Fraudsters time requests to the payment run
Urgency, secrecy or "our account is under audit"	Pressure is used to skip the call-back
Sender domain differs by a letter, a hyphen or a different suffix	Lookalike domains are cheap to register
Reply-to address differs from the sender	Your reply goes to the fraudster
New bank in a city where the vendor has no presence	Mule accounts are opened wherever convenient
Account in an individual's name for a company vendor	Company payments go to company current accounts
Request to stop using the phone, or "call only this new number"	The call-back is the one check that works

Each verification step closes a different gap. Exhibit 2 is the working checklist, with the source for each.

Exhibit 2: Checks before paying a new or changed vendor bank account

Check	Where to look (named source)	What a red flag looks like	Free or paid
Call-back to a known number	Phone number in your vendor master, the original contract, or the vendor's website	Number given only in the change email; contact unreachable or "new"	Free
Signed change request	Vendor letterhead signed by an authorised signatory	Signatory not among the directors or partners; signature unlike earlier letters	Free
Signatory is real	MCA master data and signatory details for companies and LLPs	Signer is not a current director, partner or known officer	Free
Account name matches the legal name	Cancelled cheque with printed name, or a letter from the vendor's bank	Handwritten name; cheque from another entity; name differs from the GST legal name	Free
Name confirmed by the banking system	Your bank's beneficiary name look-up for NEFT and RTGS; a penny-drop check that credits a small amount and returns the holder's name	Name returned differs from the vendor's legal name, or cannot be displayed	Free (look-up) / small fee (penny-drop service)
Legal name on record	GST portal, Search Taxpayer: legal and trade name	Account name matches the trade name of a different GSTIN	Free
Factoring or assignment	Signed notice of assignment from the vendor and the financier	Third-party account with no notice; notice only by email	Free
Change history	Your ERP or vendor-master audit log	Several changes in a short period; change made and paid by one user	Free

RBI has given payers a tool for the account-name check. Since 1 April 2025, banks in RTGS and NEFT must offer a beneficiary account name look-up free of charge. You enter the account number and IFSC, and the name held by the beneficiary bank is shown before you pay. It is available in internet and mobile banking and at branches, when adding a beneficiary and for one-off payments. If the name cannot be shown, the bank lets you proceed at your own discretion; treat that as a stop, not a pass.

Controls inside your company matter more than any single check. Exhibit 3 sets out the change-control that closes the usual gaps.

Exhibit 3: Change-control for vendor bank details

Control	What it stops	Owner
No change accepted by email alone	Compromised mailboxes and lookalike domains	Accounts payable
Call-back to a number already on file, recorded with date, person called and outcome	Fake contacts supplied by the fraudster	Accounts payable, not the requester
Separate people to request, verify and approve the change	One insider or one deceived clerk	Finance controller
Name look-up or penny-drop result saved in the vendor file	Mule accounts in another name	Treasury
Cooling-off: first payment to a new account held a few days, or a small first payment confirmed by the vendor	Time-critical fraud	Treasury
Confirmation to the vendor's previous known contact, and a monthly change report to the CFO	Changes the vendor never asked for; repeated changes	Accounts payable; internal audit

Doing it yourself, buying a verification service, and decision intelligence cover different ground. Exhibit 4 is the honest comparison.

Exhibit 4: Three ways to verify vendor bank details

Route	What it gives you	What it leaves to you	When it is enough
Your team: call-back, cheque, bank name look-up	Confirms this account, for this change	Spotting patterns across the vendor master; vendors you no longer know	Single changes at vendors you deal with often
Bank-account verification or penny-drop service	Name returned by the bank for many accounts at once	Whether the name is the right entity; related parties; why accounts changed	Bulk onboarding where names are clean
GGA decision intelligence	Vendor master tested against independent evidence: legal names, signatories, shared accounts, employee overlaps, dormant vendors	The decision on each vendor, and the forensic work on any email breach	Large vendor bases, after an attempted fraud, or before an audit

What to do if you have already paid

Speed decides whether the money can still be frozen. Act in this order.

Call your bank's fraud desk at once. Ask it to recall the payment and to ask the beneficiary bank to hold the funds. Note the reference.
Call the national cyber-crime helpline 1930, or report at cybercrime.gov.in under financial fraud. The complaint gets an ID. Police verify it and ask the banks concerned to freeze the disputed money.
File a police complaint without delay. Fraud of this kind is typically reported as cheating and cheating by personation. The usual sections are 318 and 319 of the Bharatiya Nyaya Sanhita 2023, and 66C and 66D of the Information Technology Act 2000.
Preserve the evidence: emails with full headers, the altered invoice, call logs, the payment advice.
If your own mailbox or systems were accessed, CERT-In's directions of 28 April 2022 require a body corporate to report listed cyber incidents within six hours of noticing them. The list includes unauthorised access, identity theft and phishing. Take advice on whether your incident qualifies.
Tell the real vendor through its known contact, and notify your cyber insurer if you hold a policy. Whether you still owe the vendor depends on the contract and on whose systems failed; agree nothing until you have advice.

What you can check yourself today

Five steps in under an hour test your own exposure.

Pull every vendor bank-detail change in the last 12 months from your ERP log, with who requested, verified and approved each.
Flag changes made on email alone, or approved by the same person who requested them.
Run the beneficiary name look-up on your top 20 vendors by spend and compare each name with the GST legal name.
Search for accounts shared by two vendors, and for vendor accounts that match an employee's salary account.
Write the call-back rule into your payables policy and tell your vendors you will never act on emailed bank changes.

Where self-checks stop

A verified account proves who holds it, not whether that is the right party to pay. Five gaps remain.

Genuine but wrong. A real company with a similar name, or a related firm, passes a name check.
Related parties. A vendor owned by an employee's relative passes every bank check; only a director, address and account trace shows it. See check a company's directors.
Dormant vendors. Old records with live bank details invite payments nobody notices.
Scale. Thousands of changes cannot be called back by hand.
The breach itself. Who accessed which mailbox is a question for your IT team or a cyber-forensic firm.

Bring in help after any attempted diversion, before a vendor-master clean-up or audit, or when the vendor base is too large for call-backs alone.

What you get: a decision, not a report

The decision is which vendor records you can safely pay, which to hold, and which to close. Information is available. The decision is still yours. GGA organises the evidence around that decision and reports only what changes it.

30 seconds — the answer. The GGA View on the vendor master or the single vendor: payable, hold until verified, or close. It comes with the context (spend, number of changes, controls in place), two to four facts behind the view, and the limitations. Illustrative GGA View, not a client case: "Of the changes reviewed, most match the vendor's legal name and a call-back record. Two vendors share one account. One vendor's account matches the address of an employee. Hold all three until verified."
5 minutes — the case. For each flagged vendor: identity chain, account-name evidence, signatory check, related-party links and change history.
Reference — the proof. The evidence register with sources and retrieval dates, look-up results, MCA and GST extracts.

How GGA presents evidence is shown in the executive-summary examples; how it tests it, in the methodology.

What GGA would do

GGA verifies the vendor and the account; your IT team or a forensic firm investigates any breach. The sequence shows the order of work, not a promised turnaround.

Day 1: fix the scope. One vendor's change or the whole vendor master, with spend, criticality and current controls. Unknowns are marked NOT KNOWN. You receive: a scope note and data list.
Days 2–5: Desk Intelligence. For each vendor in scope: legal name and status on MCA and GST, authorised signatories, PAN, and account-name evidence. You receive: an evidence register with the source and date of every fact.
Week 2: pattern tests across the vendor master. Shared accounts, accounts matching employee records you provide, dormant vendors with live bank details, and changes approved by one person. You receive: an exceptions list ranked by spend.
Week 2 onwards, where agreed: Subject Information. Vendors with unresolved exceptions are contacted through verified channels to confirm details. You receive: confirmations and contradictions, each sourced.
Then: Combined Assessment. You receive: the 30-second answer, the 5-minute case, an Excel management file of vendors to pay, hold or close, and the change-control gaps found.

Services: Existing Vendor Review and Vendor Portfolio Review. Related: paying an advance to a new supplier, the vendor due diligence checklist and due diligence.

What we need from you

To start

Vendor name and GSTIN, CIN or PAN
The change request as received: the email with headers, the letter and the cheque or bank letter
The old and new account details, and the invoice due
Whether any payment has already gone to the new account

To act

Your vendor master with bank details and the change log for the period in scope
Your payables policy on bank changes and approvals
Employee bank and address data for the pattern tests, if you want them run, shared under NDA
A verified contact at each vendor to be confirmed, and your consent for GGA to contact them
12–36 months of payments by vendor and account

Missing some of these? Send what you have — telling you what is missing is part of the first reply.

How you stay in control

You decide which accounts get paid. GGA gives you evidence that each decision was checked.

The decision is yours: GGA does not approve or reject a vendor or a bank change.
GGA contacts vendors only as agreed with you, and only through channels verified independently of the change request.
Bureau data, where used, is obtained only with the vendor's consent.
Every finding carries its source and date; anything not established is recorded as NOT KNOWN, never guessed.
Your data, your employees' data and vendors' personal data are handled under NDA and the DPDP Act 2023, on a need-to-know basis.
A material red flag found mid-review, such as an account shared with an employee or a payment heading to an unverified account, is reported to you immediately.

Send us the vendor's name and GSTIN or CIN, the bank-change request you received and the payment you are about to make. Within one working day a named GGA specialist replies with what we would check first and what is missing from the file — no charge, no obligation. gg@ggaindia.co.in

Checking an overseas buyer? See the Global Receivables Desk. An overseas company checking an Indian counterparty? See India counterparty due diligence.

Frequently asked questions

How do I verify a vendor's new bank account?

Call the vendor on a number you already hold, not one in the request. Ask for a signed letter from an authorised signatory with a cancelled cheque or bank letter in the vendor's legal name. Run your bank's beneficiary name look-up and compare the name with the GST legal name. A second person should approve the change.

What is penny-drop verification?

A service credits a small amount, often one rupee, to the account and returns the account holder's name from the bank. It confirms who holds the account. It does not confirm that the holder is the vendor you owe, so compare the name with the legal name on the GST and MCA records.

Can GGA trace the fraudster or recover the money?

No. Tracing and freezing are for the banks and the police, and the breach is for your IT team or a cyber-forensic firm. GGA verifies vendors and accounts, finds exposures in the vendor master and reports them to you.

Is a bank-detail change by a factoring company genuine?

It can be. A vendor that sells its receivables to a factor or a TReDS financier may direct you to pay the financier. Insist on a signed notice of assignment, confirm it with the vendor on a known number, and check the financier's account name.

Sources

This page summarises the position as at 9 November 2026. Portal features, rules and thresholds change; check the current position before relying on any single source.