Penny tests and bank detail fraud
A simple, repeatable process for checking supplier bank details before any real payment is made.
One of the most common frauds against businesses is the change-of-bank-details email. It looks like it comes from a supplier you already pay. It says their bank has changed and asks you to pay the next invoice into a new account. Sometimes the supplier's own email has been hacked, so the message is genuine-looking in every way.
The fix is a process, not a gut feeling. Never accept new bank details on the strength of an email, a letter or a phone call alone.
The four checks
1. Call back on a number you already hold
Phone the supplier using a number from your own records, such as the contract or an old invoice. Never use the phone number in the email asking for the change. Ask your usual contact to confirm the change, and record who you spoke to, when, and on what number.
2. Confirmation of Payee
Most UK banks offer Confirmation of Payee. It checks that the account name you enter matches the name on the account before you pay. It also works for business accounts, using the name the account is registered in, which may differ from a trading name. You will see one of these results:
- Match: the name matches.
- Close match: the name is similar, and your bank will show you the actual name.
- No match: stop, and check with the supplier on a known number.
- Unavailable: the check could not be done. Treat it as unconfirmed.
Be very wary of anyone who tells you to ignore a "no match" result.
3. Penny test
Pay a very small amount, such as 1p, into the new account from your banking system. Then ask the supplier, through a contact you already hold, to confirm the exact amount and reference they received. Only when they confirm do you treat the account as verified.
4. A second person releases
The person who did the call-back should not be the person who approves the change. A second person checks the evidence and releases the account for payment. This stops one person, or one compromised mailbox, from redirecting money.
Warning signs
- Urgency: "pay today or the service stops".
- A new account in a different name, or at a bank abroad.
- Small changes in the sender's email address or domain.
- A request to keep the change quiet, or to skip your usual process.
- A change arriving just before a large invoice is due.
Record keeping
Keep a record of every change request, including ones you rejected. Note the old and new details (only the last four digits of the account number need to be stored), who checked them, the call-back details, the Confirmation of Payee result, the penny test and who released it. Auditors ask for this, and it helps if something does go wrong.
If you think you've been targeted
- Contact your bank straight away. The faster you act, the better the chance of recovering money.
- In England, Wales and Northern Ireland, report it to Report Fraud, which replaced Action Fraud, or call 0300 123 2040. In Scotland, contact Police Scotland on 101.
- Tell the genuine supplier, using a contact you already hold. Their systems may be compromised.
Doing this in SupplierVault
SupplierVault records each step of a bank change: the call-back, the Confirmation of Payee result, the penny test and a second-person release. It holds the supplier's invoices in SupplierVault until the checks are done. SupplierVault never moves money itself. Your payments stay in your own banking and finance systems. Read more about bank detail fraud checks, or try it in the live demo.