Vendor Bank-Detail Change Fraud in Indian Startups: Verification and Payment-Hold Checklist
Protect startup cash when a vendor email, invoice or message suddenly asks finance to pay a new bank account.
Search intent and key terms
Primary keyword: vendor bank detail change fraud India startup
Intent: Informational and commercial investigation: Indian founders building payment controls against supplier impersonation, changed bank details and invoice-redirection fraud.
Direct answer for founders
An Indian startup should never change a vendor bank account from an email, invoice, chat or phone request alone. Finance should hold the payment, contact an authorised vendor representative through a previously trusted channel, confirm the new account, require maker-checker approval and record the change before releasing funds.
A genuine-looking request can still come from a compromised mailbox or impersonated employee. The Best CS Firm In India control is simple: no new beneficiary becomes payable until independent verification, approval and evidence are complete.
The minimum change-control record
| Field | What finance should capture | Control owner |
|---|---|---|
| Vendor identity | Legal name, vendor ID, GST and existing contact | Procurement / finance |
| Change request | Date, source, stated reason and requested effective date | Maker |
| New account | Account name, number, IFSC and bank proof | Maker |
| Independent verification | Trusted contact used, callback time and result | Verifier |
| Approvals | Commercial owner and finance checker | Checker |
| Vendor master update | Old and new values, updater and timestamp | Finance systems |
| First payment | Amount, invoice, hold release and post-payment confirmation | Payment approver |
| Evidence | Request, callback note, approvals, bank proof and system log | Control owner |
A six-step safe workflow
1. Freeze the request
Do not edit the vendor master or release payment while verification is incomplete.
2. Inspect the request
Check sender domain, reply-to address, invoice changes, tone, urgency and unusual secrecy.
3. Verify independently
Call a known authorised contact using a number already stored in the contract or vendor master—not the number supplied in the change message.
4. Approve separately
Use maker-checker approval so the person entering the change cannot approve it alone.
5. Release cautiously
Apply the approved payment limit or test-payment policy and confirm receipt with the trusted vendor contact.
Free Weekly Newsletter
Subscribe to BSA startup funding alerts
- Every Sunday, all Indian startup funding alerts in one place
- Monthly funding report on the last day of the month
- Free, concise, founder-focused, and easy to unsubscribe
Get the complete Indian startup funding roundup in your inbox, covering deals, sectors, investor moves, and founder readiness notes from the week.
Built for founders, investors, CFOs, and advisors
No spam. Unsubscribe anytime.
6. Monitor and retain
Review the first transaction, retain evidence and alert security if compromise indicators exist.
Founder-ready checklist
- Maintain authorised vendor contacts outside ordinary email threads.
- Block payment while any bank-detail change is pending verification.
- Call back using a trusted number already on record.
- Confirm the account name, number, IFSC and business reason.
- Require maker-checker approval for vendor-master edits.
- Prevent the requester, updater and payment approver from being one person.
- Review the invoice, purchase order, receipt and payment amount together.
- Log the old and new bank details with timestamps and approvers.
- Escalate mailbox compromise or impersonation indicators immediately.
Red flags that require a payment hold
| Red flag | Why it matters | Required response |
|---|---|---|
| Urgent same-day change | Pressure can bypass normal review | Hold and independently verify |
| New reply-to or lookalike domain | The sender may be impersonated | Use a trusted contact channel |
| Account name differs | Beneficiary may not match the supplier | Resolve before any payment |
| Phone number supplied in the request | The callback path may be controlled | Use the existing vendor record |
| Instruction to keep it confidential | Secrecy weakens segregation | Escalate to finance leadership |
| Invoice layout suddenly changes | The document may have been altered | Compare with contract and history |
If money was already sent
- Contact the sending bank immediately and request a hold, recall or beneficiary-bank escalation.
- Preserve the original email, headers, invoice, chat, call details and approval logs.
- Disable or secure suspected accounts and rotate exposed credentials.
- Inform the authorised vendor contact through a trusted channel.
- Escalate internally to finance, security, legal and management.
- Assess contractual, insurance, CERT-In, law-enforcement and other reporting obligations.
- Document the timeline, recovery steps, control failure and remediation.
Founder / Business Takeaway
Bank-detail changes are small data edits with large cash consequences. Build a mandatory hold, independent callback and maker-checker trail into the vendor master. A two-minute verification is cheaper than a payment recall, vendor dispute and incident investigation.
Sources and verification
https://www.cert-in.org.in/s2cMainServlet?VLCODE=CIAD-2025-0019&pageid=PUBVLNOTES02
https://cert-in.org.in/Directions70B.jsp
https://cbic-gst.gov.in/gst-invoice-rules.html
https://www.indiacode.nic.in/handle/123456789/2187?col=123456789%2F1362
Frequently Asked Questions
What is vendor bank-detail change fraud?
It is an attempt to redirect a genuine supplier payment to an account controlled by a fraudster, often through an impersonated or compromised email, invoice or message.
How should a startup verify a bank-detail change?
Use a trusted contact and channel already on record, independently call the vendor, confirm the account particulars and require documented approval before changing the vendor master.
Should finance pay an urgent changed-account request?
Urgency is a risk signal, not an exception. Place the payment on hold until independent verification and the required approvals are complete.
What if payment has already been sent?
Escalate immediately to the bank, finance lead, security and legal or compliance owner; preserve evidence and assess applicable reporting, recovery and customer or vendor communications.
Suggested internal links
Need a founder-focused review?
BSA supports Indian startups with contracts, compliance, fundraising readiness and decision-grade documentation.
