Bank details, penny tests and fraud checks

Fake requests to change a supplier's bank details are one of the most common frauds UK businesses face. SupplierVault doesn't make payments or connect to your bank. Instead it makes your team follow a safe, recorded process before anyone pays a new or changed bank account, and it holds invoices until that process is finished.

SupplierVault never moves money, never connects to bank accounts and never stores full bank account numbers. It records the last 4 digits only, so the details are useful for checking but useless to a thief.

Where to find it

On a supplier record, the Bank verification (penny test) form in the onboarding forms.
The Payments & accounts section of the supplier record, which shows "Bank verified" or "Bank not verified".
The Payments & accounts tab, for held invoices across all suppliers. See Payments and invoices.

This needs the Payments & accounts module, which is included in every plan.

The last 4 digits rule

The Account number (last 4 digits only) and IBAN (last 4 characters only) fields accept exactly four characters. Anything else is stripped, and you'll see "Enter exactly the last 4 digits" if you enter the wrong number. Exports show the account as ••••1234.

Suppliers are told the same thing in the portal: "We will never ask for your full bank account number through the portal or by email." They send full bank details on company letterhead to your accounts payable team, who confirm them with a small test payment and a call to a contact you already hold.

How a new supplier's bank details are verified

A supplier's bank is verified only when all three are true:

Bank verified = penny test passed AND call-back done AND no change of bank details open

The supplier sends full bank details on letterhead to your accounts payable team (outside SupplierVault), and fills in the set-up form with the last 4 digits.
Your finance team sends a small random test payment from your own banking system. The penny test letter on the form explains this to the supplier and asks them to email the amount and date received. It can take up to 10 days, depending on how quickly your finance team confirms.
When the supplier confirms the right amount, select Record penny test passed.
Phone the supplier on a number you already hold, never one given in the request, to confirm the details. Then select Record call-back done.
When both are recorded, the linked checklist task is completed, any held invoices are released and you'll see "Bank verified. Held invoices released."

If the penny test fails or the details don't match, set it to failed. SupplierVault warns: "Penny test failed. Don't pay. Confirm details with the supplier via a contact already on file."

How payment holds work

An invoice logged while the supplier's bank isn't verified is saved On hold, with the reason "Held: bank details unverified".
You can't mark an invoice Paid while the bank isn't verified: "Bank details aren't verified. Run the penny test and call-back before paying."
When the bank is verified, held invoices go back to Received.
Purchase requests also have a "Bank details verified" check, so orders can't be placed with an unverified supplier.

When a supplier asks to change bank details

Treat every change request as suspicious until proven otherwise. On the bank form, select Supplier has asked to change bank details.

1. Record the request

How did the request arrive? Email, Letter, Phone call, Supplier portal or On an invoice.
From: the name and email or number it came from.
New bank name and New account: last 4 digits.
Tick any Warning signs: urgency or pressure to pay quickly; a new, changed or look-alike email address; an account name that doesn't match the supplier's legal name; a new overseas bank or one they haven't used before; it arrived with an invoice or just before a payment run; it came from someone you haven't dealt with.

Select Save and hold payments. As soon as you save:

Received and matched invoices for that supplier go On hold ("Held: change of bank details being verified").
Finance gets a task "Verify change of bank details (call-back, Confirmation of Payee, penny test)", due in 2 days.
The request is labelled High risk: N warning signs when two or more signs are ticked, otherwise "Verification in progress".

2. Verify it, step by step

Call back on a number you already hold. Record the number, where it came from (your supplier record, the contract or their official website), who you spoke to and whether they confirmed. Then Record call-back.
Confirmation of Payee check. Your bank checks that the account name matches. Record Match, Close match, No match or Not available. On No match: "Treat this as suspected fraud unless the supplier can explain it on a call you made."
Penny test to the new account, then Record penny test passed.
A second person releases payments. Someone other than the person who made the call-back selects Verify and release payments. This is only possible after steps 1 to 3. The new bank name and last 4 digits are saved, the bank is marked verified and held invoices are released.

The second-person rule is enforced by the system. The person who made the call-back can't also release payments.

Choosing who can release (optional)

By default, any second person can release payments once the checks are done. To limit it, for example to Finance managers, an admin ticks names in Settings › Organisation › Who can release new bank details.

When names are ticked, only those people, or whoever is covering for one of them while they're away, can release. Anyone else sees "Only names, or whoever is covering for them, can release new bank details".
When none are ticked, any second person can release after the checks.
Someone covering for a named person releases on their behalf. The history shows "name, covering for name".
Nobody can release on behalf of the person who recorded the change or made the call-back.
The database checks these rules too.

3. Or reject it

If anything is wrong, select Reject: suspected fraud and give a reason. The original bank details are kept and SupplierVault reminds you to report it and warn the supplier. In England, Wales and Northern Ireland, report fraud to Report Fraud (reportfraud.police.uk), which replaced Action Fraud in December 2025. In Scotland, contact Police Scotland on 101. Tell your bank straight away too. Every request, accepted or rejected, stays in the Bank detail change history, with who released or rejected it.

Glossary

Penny test	A tiny payment to new bank details, confirmed by the supplier on a phone number you already hold, before any real payment is made.
Call-back	Phoning the supplier on a number you already hold (not one from the request) to confirm the details are genuine.
Confirmation of Payee	Your bank checks that the account name matches the name you entered. A mismatch is a warning sign of fraud.

When a supplier is offboarded

Marking a supplier offboarded clears its bank verification (penny test, call-back and last 4 digits) with the note "Bank details removed at offboarding". See Offboarding.

Still have a question?Email hello@suppliervault.co.uk or use the contact form. Try anything safely in the live demo.