How managing agents should handle a supplier bank detail change

When a contractor asks to change its bank details, treat the request as unconfirmed until you have called the contractor on a phone number you already hold, taken from your own supplier records and never from the request itself. Hold payments to that supplier while you check, have a second person approve the change to the supplier record, and record who checked what, and when.

This guide sets out why the procedure matters for managing agents, the steps in order, and what to do if a payment has already gone to the wrong account.

Why does a bank detail change need its own procedure?

Because a changed bank account is how payment diversion fraud gets paid. Guidance from the National Economic Crime Centre and City of London Police (Payment Diversion Fraud: what you need to know) describes this fraud as criminals impersonating others, creating or amending invoices and diverting payments to accounts they control. It is also called mandate fraud or business email compromise.

The same guidance lists a request to change the bank details of an existing supplier, or to set up a new one, as a red flag. It also notes yearly spikes affecting businesses in March and November, linked to financial year ends.

Managing agents are exposed for ordinary reasons. Each block has its own contractors for cleaning, lifts, gardening, repairs and fire safety, so an agent can hold hundreds of supplier records. Many contractors are small firms that send invoices by email. And the money paid out is the client’s, held for the leaseholders.

What does a change request look like?

• An email from the contractor’s usual address, or from one that differs by a letter or a dot.

• A letter on what looks like the contractor’s headed paper.

• An invoice with new bank details printed on it and no request at all.

• A phone call asking you to update the account before the next payment run.

• Any of these with pressure to pay outstanding invoices quickly.

An email can be made to look as if it came from someone else. In the case study in the NECC guidance, emails that appeared to come from a chief executive’s assistant were forgeries sent through a spoofing website. A familiar address or a familiar thread does not show who sent the request.

What steps should you follow?

1. Change nothing yet, and do not reply using any phone number, link or contact named in the request.

2. Hold payments to that supplier on every block it works on, including any invoice already in a payment run.

3. Call the contractor on a number you held before the request arrived, from the supplier record, the signed contract or an invoice you have already paid. Speak to someone you have dealt with before.

4. Ask them to confirm that they made the request, and to read the new account details to you. Compare what they say with the request.

5. Have a second person approve the change to the supplier record, after seeing the note of the call. The person who received the request should not be the one who approves it.

6. Record the date, how the request arrived, the number you called, who you spoke to, and who made and approved the change. Keep the request itself with the record.

7. Release the held payments. After the first payment to the new account, confirm with the contractor, on the same known number, that it arrived.

The NECC guidance puts the core of this in one line: double-check the payment request by another method, using details from another source, such as a phone call or in person. If you have any doubt about the transaction, do not transfer the money.

What if there is no phone number on file?

Then the request waits until you have one you can trust. Look for a number on a document you held before the request arrived, such as the signed contract or a past invoice. Where the contractor was engaged by a property manager, ask the property manager how they normally reach them. A number supplied in the request, or in a reply to it, does not count.

What if the same contractor works across several blocks?

Check every supplier record for that contractor. If the contractor is set up separately for different blocks or different clients, a change made on one record and missed on another leaves either a payment to the old account or an unchecked change later. Make the check once, then apply it to every record with the same evidence.

What if a payment has already gone to the new account?

Contact your bank straight away. The NECC guidance says reporting immediately to your bank and to the police gives you the best chance of recovering the money. Fraud is now reported to Report Fraud, which replaced Action Fraud on 4 December 2025, online or on 0300 123 2040.

Tell the client as well, because the payment came from their funds. Then check every other payment made to that supplier record since the change.

What should the written procedure cover?

• Who may change supplier bank details, and who may approve the change.

• What counts as a known phone number, and where it is held.

• Which payments are held while a change is checked.

• Where the record of each check is kept, and for how long.

• What contractors are told when they are set up: that bank changes are confirmed by phone before any payment, whatever the channel the request arrives by.

For the approval side of the same controls, see our guide to invoice approval workflows. A related check is covered in how to catch duplicate invoices across blocks.

Where Dataforge Invoices fits

Dataforge Invoices is AP software for UK block and estate managing agents. Duplicates, bank detail mismatches, new suppliers, purchase orders and posting limits are checked before anything is posted. The bank and VAT details on every invoice are compared with your supplier master, and the first invoice from a new supplier goes to a person. Anything uncertain goes to one review queue, with the reason named.

These checks support your existing controls. They do not on their own prove that a supplier or an invoice is genuine, and the call to a number you already hold stays with your team.

Sources: NECC and City of London Police, Payment Diversion Fraud guidance; GOV.UK, Report Fraud: new service from City of London Police. Checked 16 October 2026.