A Vendor Emails New Bank Details. Who at Your Company Can Change Them?

One email, one changed field

The email looks normal. It comes from a supplier you pay every month, or from an address that looks almost the same. It says the company moved its account to a new bank and asks you to update your records before the next invoice is paid.

Someone in accounts payable opens the vendor record, types in the new routing and account numbers and saves it. Nothing else looks different. The next payment leaves on schedule and lands in an account the real vendor has never seen. By the time the vendor calls to ask where their money is, it has often been moved again.

What the evidence says

The FBI's Internet Crime Complaint Center counted 24,768 business email compromise complaints in 2025 with more than $3 billion in reported losses. Only investment fraud cost victims more. The FBI describes these scams as aimed at businesses that work with suppliers and pay by wire on a regular basis. Wire and ACH transfers made up 86 percent of the payment types reported in these cases.

Oklahoma is in those numbers. The FBI's 2025 state report for Oklahoma lists 242 business email compromise victims and $25,377,571 in losses. The same report shows 2,469 Oklahoma victims of phishing and spoofing, which is how many of these schemes begin.

The problem is not new and it keeps growing. In a 2024 public service announcement, the FBI said business email compromise caused more than $55 billion in exposed losses between October 2013 and December 2023, with cases reported in all 50 states. The 2025 report adds that businesses reported more than $30 million in these losses in scams that involved AI.

Speed matters if it happens to you. The FBI's Recovery Asset Team worked 3,900 incidents in 2025 and froze about $679 million, a success rate of 58 percent. The FBI's advice is to call your bank right away, ask for a recall of the transfer and file a complaint at ic3.gov no matter the amount.

Why vendor data is where the loss happens

Too many people can edit the bank fields

In many accounting systems, anyone who can set up a vendor can also change that vendor's bank account. That might be five or ten people across finance and purchasing. Each one is a door a criminal only has to talk through once.

Changes leave no trail anyone reads

Some systems keep a history of edits and some do not. Even when the history exists, nobody looks at it. A change to a bank account sits in the same log as a change to a phone number, and the next payment run treats the new account like it has always been there.

The same person changes and pays

In a small team, the person who updates the vendor record is often the person who releases the payment. When one person can do both, a single convincing email is enough to move the money.

How to lock down vendor bank details

1. 1Pull a list of every user who can create or edit vendor records in your accounting system, and cut it down to the few who truly need it.
2. 2Split the work so the person who changes a vendor's bank account cannot also approve or release a payment to that vendor.
3. 3Turn on change history for vendor bank fields, and make sure it records who made the change and when.
4. 4Build a simple report of every bank detail change in the last 30 days and have someone outside accounts payable review it each week.
5. 5Require a call back to a phone number you had before the request, and record who made the call and who they spoke with.
6. 6Hold the first payment to any new or changed account until a second person checks the change was confirmed.
7. 7Write down who calls the bank and what to say if money goes to the wrong account, so nobody loses time looking for it.

What this means if you run finance or IT in Oklahoma

Careful email habits help. The FBI suggests checking the sender address closely, watching for misspelled web addresses and confirming any account change through a second channel. But criminals only need one message to get through. Controls built into your vendor data still work on the day someone clicks the wrong thing, because the system will not let one person change a bank account and send money to it on their own.

Most of this work is about who can touch which fields, what gets logged and which reports someone reads every week. That is data work, and it is often faster to fix than people expect once someone maps where the vendor data lives and who can change it.

At Oklahoma Data Partners, we work only with data and only in Oklahoma. We help companies find out who can change vendor bank details, set up change history and build the weekly reports that catch a bad change before the money moves. If you want a second set of eyes on your vendor data, book a consultation.