Everything else on a vendor record is about whether to work with them. This one is about where your money physically goes.

What is held

Field	For
Bank name	The bank.
Account number	The account.
IFSC	Indian transfers.
SWIFT	International transfers.
IBAN	International, where the country uses it.

The verified flag

Separate from the details themselves, and the most important thing on this page. It records that somebody has actually checked the account — against a cancelled cheque, or with a one-rupee penny drop — and it stores when.

Typing an account number proves nothing. It proves somebody typed an account number.

The dashboard will not let you forget

While any vendor has bank details nobody has checked, the vendor dashboard carries a standing warning:

4 vendors with a bank account nobody has checked. Paying an unverified account is how money goes missing.

It sits under Waiting on somebody, above the pipeline, and it does not go away until the accounts are checked. That is deliberate.

Why this is the one to be strict about

Invoice fraud almost always works the same way. An email arrives from what looks like a supplier, saying their bank details have changed. Somebody updates the record. The next payment goes to the fraudster.

The defence is procedural, not technical:

Treat a change of bank details exactly like new details — unverify, then re-verify.
Verify by ringing a number you already had, never a number in the email asking for the change.
Keep approve and edit in different people’s hands.
Do a penny drop and confirm the name that comes back matches the vendor.

An email is not verification. Neither is a letterhead. Both are trivially forged, and both are what every successful invoice fraud has relied on.

What a penny drop actually proves

You send one rupee to the account and the bank tells you the name on it. That is the bit that matters — not that the transfer worked, but that the name that came back is the vendor you think you are paying.

A cancelled cheque proves the same thing on paper. Either is fine. What proves nothing:

The details being typed neatly.
The details arriving on a letterhead.
The details arriving from an email address you recognise. Addresses are spoofed; accounts are compromised.
The vendor confirming them by email, using the same channel that asked for the change.

When a vendor says their bank has changed

Treat it as new details, every time, without exception:

Unverify the account the moment you change it.
Ring the vendor on a number you already had on file — never a number in the message asking for the change.
Ask for the change to be confirmed by somebody you have spoken to before.
Do a penny drop and check the name.
Only then mark it verified again.

It takes ten minutes. The alternative is a payment that cannot be recalled, to an account that is emptied within the hour, against an invoice you still owe.

This attack is not exotic and it is not rare. It is the single most common way money is stolen from businesses of this size, and it works because the request always looks completely ordinary.

Where to go next

Next in vendors The vendor pipeline → When a vendor goes quiet →

Something missing or wrong here? Tell us. A question that needed asking usually means a page that needed writing.

Bank details, and checking them