Quick answer
Validate a supplier’s bank-change request through a trusted channel independent of the request itself, then separately approve the account change and payment. Inspect queued batches as well as the supplier master. A correct invoice and familiar email address do not prove the destination is legitimate. If fraud is discovered, contact the originating bank promptly and preserve the evidence.
A software implementation often involves large initial invoices, unfamiliar project contacts and urgent requests near a payment deadline. Those conditions make the supplier-master change a critical part of procurement execution. The invoice can be genuine while the new payment destination is fraudulent.
The FBI's Internet Crime Complaint Center recommends secondary-channel verification of account-information changes. If a business email compromise is recognized, it advises contacting the originating financial institution promptly to request recall or reversal and filing a detailed complaint. Recovery is not assured. FBI IC3 guidance.
Separate four approvals
The controller should be able to distinguish that the goods or services were received, the invoice is payable, the supplier's account change is authentic and the payment is authorized for release. Combining these into one approval makes it easy for evidence about the invoice to be mistaken for evidence about the bank account.
Maintain a trusted supplier contact established through the approved onboarding process. A new number supplied in the change email is part of the unverified request. A callback to that number does not create an independent check.
Rehearse an urgent implementation invoice
In a synthetic case, a $48,000 implementation invoice is due Friday. On Thursday, a message from the usual supplier address says the bank account changed and asks for immediate payment. The invoice number and project milestones are correct.
The payable team pauses the change, contacts the supplier through the previously verified channel and records who confirmed the request. A second authorized person reviews the evidence and account details before the master record changes. Payment release then follows the normal approval process using the verified destination.
These are proposed control steps, not a government-mandated division of duties for every SNF. A smaller organization may need a different independent review arrangement, but the person creating the change should not be the only evidence that it is legitimate.
Inspect the payment batch, not just the master record
Some systems snapshot bank details when the batch is created; others read the current master at release. Ask the supplier to demonstrate the actual behavior. A verified master update may leave an old queued payment unchanged, while a malicious update could affect many queued invoices at once.
| Test | Evidence required |
|---|---|
| Change submitted after a batch is prepared | Which destination the pending payment will use and whether reapproval is required |
| One employee attempts change and release | Enforced separation or a documented independent compensating review |
| Account changed and quickly changed back | Complete history, prior values and alerts available to reviewers |
| Supplier contact also changes | Independent verification of both changes rather than reliance on the new contact |
| Emergency exception requested | Named authority, reason and retained verification evidence |
Protect full bank details in logs and approval messages. Reviewers need enough information to verify the destination without distributing sensitive account data unnecessarily.
Prepare the response before a loss
Keep an accessible contact route for the originating bank and an internal escalation path. If a fraudulent transfer is discovered, preserve the request, message headers where available, account-change history, approvals, payment identifiers and timestamps. Contact the bank promptly; do not delay that call while waiting for a perfect incident report.
Coordinate IT investigation if an email account may be compromised. A payment correction alone may leave the attacker able to send another request. Assess related invoices and pending changes without assuming every transaction is affected.
The buyer's decision is whether the procurement and payable systems preserve independent verification and expose the final destination before release. Ease's skilled nursing offering is planned; any future supplier-payment integration would need explicit responsibilities and testing across the actual payable and banking systems.
Questions & answers
Is replying to the supplier’s bank-change email independent verification?
No. A compromised account can control that conversation. Use a trusted contact method established independently of the request and verify the intended account change through the approved process.
Does an approved invoice make its new bank account safe to pay?
No. Invoice validity, supplier identity, bank-change authorization and payment release are distinct checks. A legitimate invoice can still be redirected to a fraudulent destination.
Primary sources
Use the cited source and its applicable version when making a facility-specific decision. These guides explain operational evaluation methods; they are not individualized clinical, coding, or legal advice.