How Do I Approve New Vendors and Stop Fake Bank Change Requests?

The short answer

Before you pay a new vendor, confirm they’re real, get their tax form and payment details in writing, and have an owner approve them. If any vendor asks to change their bank account or payment address, don’t act on the email. Call them at a phone number you already had on file, confirm the change, and log the call before anyone updates the payment details.

What this tells Google and AI

This is a foundation step. Search engines don’t see your vendor list. But the scams that trick businesses into paying fake bank accounts often start with a hacked or faked email. The same tricks are used to steal logins for websites, domains, and Google Business Profiles. A business that checks before it acts protects its money and its online accounts.

What this means

10.6.3 Vendor approval is the check you do before a new supplier, contractor, or service gets paid for the first time.

10.6.4 Bank-change verification is confirming, outside of email, that a request to change where you send money is real.

The Federal Bureau of Investigation (FBI) calls this kind of fraud business email compromise. A criminal sends an email that looks like it’s from a vendor you know, often with an invoice and new payment details. The FBI’s advice includes verifying any change in account number or payment steps directly with the person, and looking up the phone number yourself instead of using one in the message.

Made-up example: Blue Heron Plumbing gets an email that looks like it’s from its pipe supplier. It says the supplier “changed banks” and attaches new wire instructions. The office manager doesn’t reply. She calls the supplier’s number from last year’s invoice. The supplier never sent the email. The owner reports it and tells the supplier their email may be compromised.

Why it matters

• Money sent to a fake account is often gone. Recovery is hard and slow.
• The email can look perfect. It may come from the vendor’s real account if they were hacked.
• Pressure is part of the scam. The FBI notes that requests pushing you to act fast are a warning sign.
• Fake vendors get created when nobody checks before the first payment.
• Tax reporting needs vendor info. The Internal Revenue Service (IRS) says to have independent contractors fill out Form W-9 so you have their correct name and taxpayer number (see 10.3.5 Information Returns).

Who this applies to

Every business that pays vendors, contractors, or subcontractors by check, bank transfer, wire, or payment app.

How to do it

Approving a new vendor

1. Confirm the business is real. Check its website, address, and phone number on your own, not just from its email.
2. Collect Form W-9 from contractors and other vendors you may need to report. The IRS says to keep it on file for four years.
3. Get a certificate of insurance from subcontractors who work on your jobs (see 11.2.6 Insurance Certificates from Vendors).
4. Get payment details in writing, on the vendor’s letterhead or invoice.
5. Call to confirm the bank details using the vendor’s phone number you found yourself.
6. Have an owner approve the new vendor before the first payment.
7. Add them to your approved vendor list in your bookkeeping software.

Verifying a bank change

1. Never change payment details from an email, text, or voicemail alone.
2. Call the vendor at the number you already have on file. Don’t use any number in the request.
3. Speak to someone you know if you can, and confirm the old and new details.
4. Log the callback: date, who you spoke to, the number you called, and what was confirmed.
5. Have a second person approve the change before it’s saved (see 10.6.8 Separation of Duties).
6. Watch the next payment to make sure it reaches the vendor.
7. If you think you paid a fake account, call your bank’s fraud line right away and report it at the FBI’s Internet Crime Complaint Center (see 11.9.5 Payment Fraud).

What proof to keep

• Vendor setup checklist for each vendor
• Form W-9 and insurance certificates
• Owner approval for each new vendor
• A bank-change log with callback details and second approval

Common mistakes

• Replying to the email to “confirm.” You’re talking to the scammer.
• Calling the number in the email signature. It may be fake.
• Changing details because the request looks urgent.
• Letting the person who enters vendors also approve and pay them.
• Skipping the W-9 until tax season, when the vendor is hard to reach.

When to get help from a pro

Your bank’s fraud team can explain tools like payee checks and transfer limits. A certified public accountant (CPA) can tell you which vendors need W-9s and 1099s. Questions to ask:

• What fraud protection tools does my bank offer for business transfers?
• Which of my vendors will I need to send information returns to?
• What should I do in the first hour if I sent money to the wrong account?

Bill’s note

[Bill: add a short note. For example, a fake bank-change or invoice email you or a client received, and how a callback stopped it.]

How I did this for SiteSmarty

• [Date I did this:]
• [What I actually did, step by step: the vendor setup checklist and callback rule I use for SiteSmarty]
• [What it cost and how long it took:]
• [What surprised me or what I’d do differently:]
• [Screenshot or photo to add, with private info blurred: the vendor checklist and a logged callback]
• [Result so far:]

Questions people ask

What should I collect before paying a new vendor? Proof they’re real, a Form W-9 if needed, insurance for subcontractors, written payment details, and an owner’s approval.

Is it safe to change bank details from an email? No. Call the vendor at a number you already trust and confirm first.

What is business email compromise? A scam where someone sends an email that looks like it’s from a known contact and asks you to send money or change payment details.

What if I already paid a fake account? Call your bank’s fraud line right away, then report it to the FBI’s Internet Crime Complaint Center.

Audit check

Line	Question	Pass looks like	Fail looks like	Evidence to collect
10.6.3 Vendor approval	Is every vendor checked, documented, and approved by an owner before the first payment?	Vendor checklist complete. W-9 and insurance on file where needed. Owner approval recorded.	Vendors added from an email. No W-9s. No approval.	Approved vendor list, three vendor files with W-9 and approval
10.6.4 Bank-change verification	Is every bank or payment change confirmed by a callback to a known number and approved by a second person?	Bank-change log with callback details and second approval for every change.	Changes made from emails. Callbacks to numbers in the request. No log.	Bank-change log, written callback rule

Where this fits

Do this first: 10.6.1 Spending and Refund Authority

Do this next: 10.6.5 Owner Reimbursements

Related pages: 10.5.7 Accounts Payable, 10.3.5 Information Returns, 11.2.1 Vendor Agreement, 11.2.6 Insurance Certificates from Vendors, 11.9.5 Payment Fraud, 12.1.6 Email Security

Sources

• Federal Bureau of Investigation, "Business Email Compromise" (checked October 17, 2026)
• IRS, "Forms and associated taxes for independent contractors" (checked October 17, 2026)
• IRS, "Instructions for the Requester of Form W-9" (checked October 17, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.