Callback Verification Before Changing Vendor Payment Details

Callback verification means that before anyone changes a vendor's bank account or payment details, a staff member places an outbound phone call to the vendor using a number already on file or found independently, never a number supplied in the change request. A second person approves the change, payments to the new account wait until verification is complete, and the call is logged. It is a core control against business email compromise payment fraud, and it only works if nobody is allowed to skip it.

Why callback verification matters

Payment-change fraud does not need malware. An attacker sends an email that looks like a real supplier, or comes from the supplier's compromised mailbox, and asks you to pay a new account. The FBI's Internet Crime Complaint Center reported in September 2024 that business email compromise produced more than $55 billion in exposed losses worldwide between October 2013 and December 2023.

The FBI's advice is to use a secondary channel to verify requests for changes in account information. CISA's earlier BEC alert is more specific: verify a change in payment instructions by phoning to confirm, and the number "should not come from the electronic communication." A callback is that secondary channel, done in a way an attacker controlling the email cannot intercept.

What is the exact callback workflow?

Freeze the change, call the vendor on a number you already trust, confirm the details with the person who owns the account, get a second approval, and only then update the vendor record. Every step is recorded.

1. Receive and freeze. Any request to change bank details, remittance address or payment method goes to a single queue. No change is made and no payment is redirected yet.
2. Find a trusted number. Use the number in your vendor master file from onboarding, a signed contract, or a prior invoice received before the change request. If none exists, look up the vendor's main line independently on their official website. Do not use any number, signature block or link in the request.
3. Call out. Place an outbound call. J.P. Morgan's 2026 callback guidance says: "Always make an outbound call to verify the person is genuine," and use "a trusted number from a system of record."
4. Reach the right person. Speak to your known contact or the person responsible for the vendor's billing, not whoever answers. Ask them to confirm the request exists and to read back the new details, rather than reading them out yourself.
5. Second approval. A different employee reviews the call record and approves the change. The person who entered the change should not also release the next payment.
6. Hold the first payment. Keep a hold on the first payment to the new account until verification and approval are complete.
7. Record and close. File the verification record (below) with the vendor record.

Separation of duties and dual approval

Callback is one control. It needs two others behind it.

J.P. Morgan's payments guidance recommends "dual payment authority, which requires that two people review payment instructions," and that "employees who approve vendor information should be separate from those who actually pay the invoice." CISA's BEC alert recommends limiting the number of employees who can approve or conduct wire transfers and requiring additional approval for payments to new bank accounts for existing partners.

In a small company, this can be as simple as: the AP clerk receives and calls, the controller or owner approves the vendor master change, and a different person releases payment. If you have only two people in finance, the owner is the second approver.

What if the vendor cannot be reached?

Keep the hold. A legitimate vendor can wait a day for a payment while you verify, and pressure to skip the call is itself a warning sign.

If you cannot reach anyone on the trusted number, escalate to the manager who owns the vendor relationship, try the vendor's main line from their official site, and do not change the record. CISA's guidance says staff should delay the transaction until additional verification can be performed. If you suspect fraud or money has already moved, call your bank immediately to request a recall, then report to the FBI at ic3.gov.

Common failure modes

Most callback failures happen because the control was followed in name only:

• Replying to the same email thread. If the thread is compromised, the attacker answers. Another email is not a second channel.
• Accepting an inbound call. A caller saying they are the vendor proves nothing. J.P. Morgan advises against asking vendors to call you or relying on an inbound call to update contact information.
• Using the number in the suspicious message. The attacker controls that number. Use only a number from your own records or an independent lookup.
• Changing the contact details first. A request to update the vendor's phone number or email, followed by a bank change, defeats the callback. Treat contact changes with the same verification.
• Letting urgency win. "The CFO needs this paid today" is the most common pressure. The rule must allow a hold without blame.
• Assuming it was done. J.P. Morgan recommends verifying each step instead of taking a colleague's word that a callback happened. The approver should check the record.

Callback call script

Keep it short and consistent so staff do not improvise:

"Hello, this is (name) from (company) accounts payable. We received a request to change your company's payment details. Can you confirm whether your company sent that request? Please read me the new bank name, routing number and the last four digits of the account. Who in your team authorized the change, and what is the best number to reach them? Thank you. We will apply the change after our internal approval."

If anything does not match, or the person seems unaware of the request, stop, do not apply the change and escalate.

Verification evidence log

Record one entry per change request:

• Vendor and vendor ID
• Request received: date, time, channel and sender address
• Details requested: new bank, account last four digits, effective date
• Trusted number used and where it came from: vendor master file, contract, prior invoice or official website
• Call made by, date, time, person reached and their role
• Outcome: confirmed, not confirmed or unreachable
• Second approver and date
• Hold released by and date

One-page callback checklist

• Freeze the change; no payment to new details yet.
• Find the trusted number from your records, never from the request.
• Place an outbound call and reach a known contact.
• Have the vendor read the new details back to you.
• Get a second person to approve the vendor record change.
• Hold the first payment until verification is complete.
• Log the call and file the record.
• If anything is wrong or unreachable: hold, escalate, call your bank if money moved.

Does callback verification affect insurance coverage?

It can, depending on the policy. Some crime and cyber policies include callback or authentication provisions for social engineering losses, so a missing or undocumented callback can matter when a claim is made. Read your own wording.

Amwins, a wholesale broker, wrote in November 2024 that buyers should be "cautious of provisions related to callback and authentication procedures," which "will often limit coverage for social engineering losses." Brown & Brown wrote in October 2024 that coverage "is typically limited or excluded if a phone call is not made when a policy has such a requirement." Those are broker observations, not a universal rule, and wording varies by carrier and policy. A documented callback is a good control on its own merits, but it does not promise coverage, a limit or claim payment, and this is not legal advice. Ask your broker whether your policy has a callback condition and what evidence it expects.

Many payment-change requests come from a vendor's or a colleague's hijacked mailbox, which is one reason applications ask about email MFA. See how to answer the MFA section of a cyber insurance application.

Sources

• J.P. Morgan: BEC busters, four callback do's and don'ts (February 2026)
• J.P. Morgan: Fraud prevention, 8 best practices for payments staff (June 2022)
• FBI IC3: Business Email Compromise, The $55 Billion Scam (September 2024)
• CISA: Business Email Compromise Continues to Swindle and Defraud U.S. Businesses (TA15-175A)
• Amwins: How Cyber and Crime Insurance Policies Respond to Social Engineering (November 2024)
• Brown & Brown: The ins and outs of social engineering coverage (October 2024)