A supplier emailed new bank details. What should I do?

Do not change anything or pay yet. Call the supplier on contact details you already hold in your own records, not on a number in the email, read the old and new details back, and have a second person approve the change. UK police guidance also suggests a small test payment before a large one.

Why check supplier contact details against their website?

The call-back rule only works if the contact details on file are right. NHS Counter Fraud guidance warns that fraudsters may first ask for contact details on file to be amended. Comparing your file with the phone numbers and shared mailboxes on the supplier's own website shows which records to confirm before a change request arrives.

Does the bank check the payee name on a transfer?

Often not: PSNI guidance says that in most cases only the sort code and account number are checked. Where your bank offers a payee name check, such as Confirmation of Payee in the UK, use it as well.

Supplier bank details changed? A call-back sheet that checks every supplier's phone and email on file against the supplier's own website, and logs each change request before you pay

Updated 22 Oct 2026 · Disclosure: the contact details scraper linked below is an Unadhi product on the Apify Store. This guide is free, and the call-back log and checks work without it if you type the website details in by hand. Current Apify pricing is only on the Store page. This page has no affiliate links and nobody paid to be mentioned. This is general information, not legal or banking advice.

What you get: one Google Sheet that protects your supplier payments from "our bank details have changed" emails (called mandate fraud, payment diversion fraud or business email compromise). The suppliers tab has one row per supplier: the phone number and email you hold on file, next to the phone numbers and shared mailboxes the supplier publishes on its own website, with a plain-English flag on every row where they disagree (phone on file not on website, email on file is on a different domain, contact changed recently, website could not be read). You clean up those rows before a change request arrives. The change requests tab is the call-back log: every request to change bank details gets one row, and the verdict column says "Do not pay yet" until someone has called a number from your own records, read the details back, and a second person has approved. Formulas are below. The example rows are made up.

The finished sheet

suppliers tab (example rows are made up)

Supplier	Website domain	Phone on file	Email on file	Phones on supplier website	Phone check	Email check	Status
Northfield Packaging	northfield-packaging.example	+44 20 7946 0123	accounts@northfield-packaging.example	+442079460123 +442079460456	On website	Same domain	Ready
Bright Print Co	brightprint.example	07700 900321	brightprint.accounts@gmail.example	+442079460789	Not on website	Different domain	Check before next payment
Coastline Freight	coastline-freight.example	+44 20 7946 0999	billing@coastline-freight.example	not scraped (blocked-by-robots)		Same domain	Check by hand

change requests tab (example row is made up)

Received	Supplier	Sender address	Sender domain	Number called	Where the number came from	Details read back	Second approver	Verdict
21/10/2026	Bright Print Co	accounts@brightprlnt.example	Not the supplier's domain					Do not pay yet

The Bright Print row shows why the suppliers tab matters: its email on file is a free-mail address and its phone on file is a mobile that the supplier's website does not list. If a "new bank details" email comes from a look-alike domain (brightprlnt with an L instead of an i), the team should call the website-listed switchboard and ask for accounts, not the mobile on file, and certainly not a number in the email.

Who this is for

Small businesses that pay suppliers by bank transfer, and the bookkeepers, accountants and outsourced finance teams who run payments for them. UK police guidance says a request to change a supplier's bank account is unusual and should be treated with suspicion, and every official source below gives the same core rule: verify the change by calling the supplier on contact details you already hold, never on details in the request. That rule only works if the contact details you hold are right. NHS Counter Fraud guidance warns that fraudsters may first ask you to amend the contact details on file, as a step before the bank-detail change. This sheet checks your file against a second, independent source: what each supplier publishes on its own website.

Step 1: list your suppliers

Export your supplier list from your accounting software (most have a contacts or suppliers export to CSV) and paste it into a tab named suppliers with these headers in row 1:

Col	Header	What goes in it
A	Supplier	Name as in your accounts
B	Website domain	The supplier's own website, without `https://` or `www.`, for example `northfield-packaging.example`. Take it from a past invoice or contract you already trust, not from a new email.
C	Phone on file	The number your payments team would call today
D	Email on file	The address remittances and invoices come from
E	Contact last changed	Date the phone or email on file was last edited (blank if never)

Start with the suppliers you pay most, or most often. Those are the ones worth a fraudster's time.

Step 2: read each supplier's own website

With the contact details scraper

Open the Contact Details Scraper on the Apify Store, paste column B into the plain list field and run it with this input:

{
  "urls": ["northfield-packaging.example", "brightprint.example", "coastline-freight.example"],
  "maxPagesPerSite": 4,
  "checkEmailMx": true,
  "defaultCountry": "GB"
}

You get one row per website: the homepage plus the most contact-like pages (contact, about, impressum, support). maxPagesPerSite defaults to 4. You pay only for pages actually fetched.
Phones are normalised to international format (+442079460123), and tel: links on the page are preferred. Set defaultCountry to the country your suppliers are in, so local-format numbers are read correctly when the domain does not say.
Only shared mailboxes (accounts@, info@, sales@) are returned by default; addresses that identify one person are dropped and only counted. For this job that is what you want: the accounts or main office mailbox.
Every email and phone carries foundOn, the page it was read from, so you can open that page and see it yourself before you rely on it.
The scraper follows robots.txt and reads each site's terms. Sites that disallow it come back with a status such as blocked-by-robots or blocked-by-terms and are not charged; the sheet marks them "Check by hand".

Export the run's dataset as CSV and import it into the same Google Sheet as a new tab named scrape (File → Import → Upload → Insert new sheet). Do not rename headers. You get columns such as domain, status, phones/0/phone, phones/1/phone, emails/0/email, emails/0/mxValid and phones/0/foundOn.

Free, by hand

For a handful of suppliers, open each website yourself (type the address; do not click a link in an email), copy the main phone number and accounts mailbox from the contact page into a scrape tab with the same three headers domain, phones/0/phone and emails/0/email, and the formulas below work unchanged.

Step 3: the check columns on the suppliers tab

Add these headers in F1 to J1 and the formulas in row 2, then copy down.

F2 (Phones on supplier website):
=IF(B2="", "", IFERROR(LET(h, scrape!$A$1:$ZZ$1,
   r, MATCH(LOWER(B2), INDEX(scrape!$A$2:$ZZ, 0, MATCH("domain", h, 0)), 0),
   st, INDEX(scrape!$A$2:$ZZ, r, MATCH("status", h, 0)),
   p, TEXTJOIN(" ", TRUE, FILTER(INDEX(scrape!$A$2:$ZZ, r, 0), REGEXMATCH(h, "^phones/\d+/phone$"))),
   IF(AND(st<>"", st<>"ok"), "not scraped ("&st&")", p)), "not scraped"))

G2 (Mailboxes on supplier website):
=IF(B2="", "", IFERROR(LET(h, scrape!$A$1:$ZZ$1,
   r, MATCH(LOWER(B2), INDEX(scrape!$A$2:$ZZ, 0, MATCH("domain", h, 0)), 0),
   TEXTJOIN(" ", TRUE, FILTER(INDEX(scrape!$A$2:$ZZ, r, 0), REGEXMATCH(h, "^emails/\d+/email$")))), ""))

H2 (Phone check):
=IF(OR(C2="", F2="", LEFT(F2, 11)="not scraped"), "",
   IF(REGEXMATCH(REGEXREPLACE(F2, "[^0-9 ]", ""), RIGHT(REGEXREPLACE(C2, "[^0-9]", ""), 9)),
      "On website", "Not on website"))

I2 (Email check):
=IF(OR(D2="", B2=""), "", IF(REGEXMATCH(LOWER(D2), "@([a-z0-9-]+\.)*"&REGEXREPLACE(LOWER(B2), "\.", "\\.")&"$"),
   "Same domain", "Different domain"))

J2 (Status):
=IF(A2="", "", IF(LEFT(F2, 11)="not scraped", "Check by hand",
   IF(OR(H2="Not on website", I2="Different domain", AND(E2<>"", TODAY()-E2<=90)),
      "Check before next payment", IF(H2="", "Check by hand", "Ready"))))

Phone check compares the last 9 digits of your number with the website numbers, so 020 7946 0123 on file matches +442079460123 on the website. Short numbers (fewer than 9 digits) will not match reliably; check those by eye.
Email check accepts the supplier's domain and its subdomains (accounts@billing.northfield-packaging.example). A free-mail address or a different domain on file is not proof of fraud, since many small suppliers use one, but it means the email on file cannot be checked against the website, so the phone on file matters more.
Contact changed in the last 90 days is flagged because of the NHS Counter Fraud warning that a contact-detail change can come first. Ask who changed it and on what evidence.
For each "Check before next payment" row, call the website-listed switchboard, ask for accounts, and confirm the phone and email you hold. Update your file, write the date in column E, and note who confirmed it.

Step 4: the change requests tab (the call-back log)

Every request to change a supplier's bank details, or to pay a new account, gets one row before anything is changed in your accounting or banking software. Headers in row 1:

Col	Header	Entry
A	Received	Date
B	Supplier	Exactly as in the suppliers tab (use a drop-down: Data → Data validation → Dropdown from a range → suppliers!A2:A)
C	Sender address	The full address the request came from (open the sender details; display names can be faked)
D	Sender domain	Formula below
E	Number called	The number you rang
F	Where the number came from	Drop-down: `Our records (suppliers tab)`, `Supplier website, typed in by us`, `The request itself`
G	Details read back	Drop-down Yes / No: you read the old and the new account details back to the supplier on the call, and they confirmed the change
H	Second approver	Name or initials of a second person who approved the change
I	Test payment confirmed	For large payments: Yes once a small first payment has been confirmed by the supplier, or N/A
J	Verdict	Formula below

D2: =IF(C2="", "", LET(d, LOWER(REGEXEXTRACT(C2, "@(.+)$")),
      w, LOWER(IFERROR(VLOOKUP(B2, suppliers!$A:$B, 2, FALSE), "")),
      IF(w="", "Supplier not in list",
         IF(REGEXMATCH(d, "(^|\.)"&REGEXREPLACE(w, "\.", "\\.")&"$"), "Supplier's domain", "Not the supplier's domain"))))

J2: =IF(A2="", "",
      IF(F2="The request itself", "Stop: call a number from your records",
      IF(AND(E2<>"", OR(F2="Our records (suppliers tab)", F2="Supplier website, typed in by us"),
             G2="Yes", H2<>"", I2<>""), "OK to change", "Do not pay yet")))

"Supplier's domain" does not make a request genuine: a supplier's real mailbox can be taken over, and the fraud email then comes from the right address. That is why the verdict depends on the call, not on column D. "Not the supplier's domain" (a look-alike such as brightprlnt) is a strong reason to stop.
If the call gets you a person who says "just reply to the email", or the request is urgent and unusual, stop and escalate. Urgency and last-minute changes to account details are red flags in both UK police and FBI guidance.
Report Fraud (the UK police service) suggests a small test payment, confirmed by the supplier, before sending a large sum to a new account. Column I records that.
Keep this tab private (Share → Restricted). It holds supplier bank and contact information.

If money has already gone

Call your bank straight away and ask them to contact the receiving bank and try to recall the payment. Then report it: in the UK to Report Fraud on 0300 123 2040 or online; in the US to the FBI's IC3 at ic3.gov; elsewhere to your national police cyber-crime or fraud reporting service. Note the time of each call in the change requests tab.

Honest notes

The website is a second source, not the first. Official guidance says to call on details from your own records; the website check is there to catch records that are already wrong. Always type the supplier's address yourself or use the domain from a past invoice you trust.
The sheet does not verify a bank account. In most cases a bank transfer is checked only against the account number and sort code, not the payee name (PSNI). Where your bank offers a payee name check (in the UK, Confirmation of Payee), use it as well.
Only the supplier's public business contact details are used. Personal staff emails are dropped by the scraper's default.

Partner programme opening soon

Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.

Sources

Verify a request to move money to a new account by contacting the supplier on official and verifiable contact details; consider a small test payment first; only designated employees should change payment details: Report Fraud (UK police), Mandate fraud (read 22 Oct 2026).
Bank-account changes are unusual and should be treated with suspicion and authorised at a senior level; call back using records in your system, not the letter; usually only sort code and account number are checked, not the payee name: Police Service of Northern Ireland, Mandate fraud (read 22 Oct 2026).
Contact the supplier on details in existing records, not from the change request; fraudsters may first ask for contact details on file to be amended: NHS Counter Fraud Authority, Mandate fraud quick guide (PDF, read 22 Oct 2026).
Use secondary channels to verify requests to change account information; contact your bank first and file a complaint at ic3.gov: FBI Internet Crime Complaint Center, Business Email Compromise (read 22 Oct 2026).
Red flags (unexplained urgency, last-minute changes in account information) and "verify any changes via the contact on file, not the number provided in the email": FBI Sacramento, business email compromise advice (read 22 Oct 2026).
Contact details scraper inputs and outputs (urls, maxPagesPerSite default 4, contact-like pages, E.164 phones with tel: links preferred, defaultCountry, role mailboxes only by default, foundOn, mxValid, status values, skipped sites not charged): Apify Store page (Actor input schema, README and source read 22 Oct 2026).

← All guides

Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.